IT security certainly is an unusual business. The types and magnitudes of the threats we face today would be almost unimaginable just a few years ago. E-mail viruses have been with us since 1999 [1], but the delivery mechanisms have become more effective and more insidious. For years, security folks were warning us about the growing problems associated with identity theft, and we had been waiting quite some time for the inevitable big Internet worm that would succeed the Morris Worm of 1988 [2]. We now deal with these situations on a daily basis.

Metrics and performance benchmarks might look like they're about information and data, but it's not so simple. They're really about people. "Wait," you say, "it's just business. Benchmarking is about determining the state of the business, much like getting an annual physical, with a blood test for cholesterol. Or that benchmarking is like taking a photograph of company performance and looking at the picture to evaluate what we're seeing." Yet there are people who strongly resist going to the doctor as well as those who intensely dislike having their picture taken.