Hot New Gameshow: My Favorite Metric!

### Overview At the S4 conference, the fast-paced game show session "My Favorite Metric!" challenged contestants to present their favorite operational technology (OT) and industrial control system (ICS) security metric in three minutes or less. Presentations were evaluated by a four-judge panel—Kyle McMillan, John Ballentine, Grace Peterson, and Maggie Moranti—scoring each pitch from 1 to 10. The winner received a $2,000 cash prize, while second place was awarded $500.

### Key Topics Contestants pitched distinct quantitative approaches to measuring OT security posture, ranging from technical response metrics to physical risk analogies: - **Incident Root Cause Analysis Rate (RCA Rate):** Moving beyond speed-only metrics like Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) to measure how frequently incidents are analyzed down to their root causes. - **Cyber Risk Reduction Factor (SURF / CyRF):** Quantifying the effectiveness of implemented counter-measures by subtracting residual risk from baseline risk. - **Advanced Persistent Drinker (APD):** An operational physical security metric analyzing physical site break-ins and discarded beer cans to determine dwell time and coordinate with law enforcement. - **Cybersecurity Debt:** Framing unpatched vulnerabilities, missing segmentation, and neglected training analogously to corporate environmental and carbon debt. - **Security over Safety Ratios (SSR):** Establishing comparative metrics linking security expenditures, alerts, and incidents directly to established industrial safety metrics. - **Critical Vulnerability Closure Rate:** A simple ratio tracking resolved critical vulnerabilities against total discovered critical vulnerabilities over a set time window.

### Technical Details - **Ez Tahoon (Score: 32 - 1st Place):** Pitched the Incident Root Cause Analysis Rate. Tahoon argued that focusing exclusively on MTTD/MTTR incentivizes analysts to treat superficial symptoms rather than underlying causes, leading to recurring incidents. Tracking RCA rate promotes correlation, contextualization, playbook tuning, and detection engineering across IT and OT. - **David (Score: 25):** Representing Attila Cybertech, David proposed the Cyber Risk Reduction Factor (CyRF / SURF). Calculated as $A - B$ (where $A$ is current risk without countermeasures and $B$ is residual risk after implementation), it quantifies the net impact of mitigations. - **Jack Schultz (Score: 31 - 2nd Place):** Presented the Advanced Persistent Drinker metric, drawn from recurring summer break-ins across remote wind generation sites. By categorizing beer types and counting cans (e.g., estimating consumption time across 2–4 individuals), teams derived attacker dwell time to align law enforcement dispatch times. - **Thomas Vasan (Score: 26):** Framed technical OT requirements (MFA, ISA/IEC 62443 zones and conduits, DMZ hardening) into a cumulative "Cybersecurity Debt" model inspired by corporate carbon accounting and Paris Agreement sustainability targets. - **VC Ponada (Score: 29):** Proposed the Security over Safety Ratios (SSR) family, mirroring financial ratios to bridge OT security with ICS safety culture. Variations included comparing security investment dollars to safety investment dollars, severe alerts to near misses, and security incidents to safety incidents. - **Enrique Dominguez (Score: 30):** Pitched the Critical Vulnerability Closure Rate, computed by dividing fixed critical vulnerabilities by total discovered critical vulnerabilities within a given timeframe to provide an objective, readily available indicator of progress.

### Takeaways The session highlighted that effective OT security metrics must balance technical rigor with operational clarity. While complex risk formulas often struggle with subjective scoring and executive buy-in, metrics that drive actionable behavior—such as resolving root causes, matching physical security response times, or aligning security investments directly with industrial safety standards—garner the strongest reception from practitioners and leadership alike.