Rant for the day

We live in a quantitative world. Things that can be measured and compared tend to be valued - pay packets, house prices, interest rates. Often this means that quantitative is equated with good, and qualitative with not as good as quantitative. Less critical thought evaluates quantitative measures - often as long as a traffic light is reflected in the colouring they are accepted. This should not be the case. We use qualitative approaches to select quantitative measures, and we should be using more qualitative measures if we are to report fully on any phenomena.

I was at a seminar this morning that devoted a session to discussing quantitative measures for information security. Now, I'm not suggesting that we shouldn't have quantitative information security measures. But equally, quantitative measures are not the only ones that could be applied. Properly selected, qualitiative measures would also be valuable. But because they can't be reduced to numbers on an executive dashboard, they aren't seen as valuable.

Sigh. Just think of it this way - how do we compare houses? Generally, it's on cost, number of rooms, land size etc etc ... but who hasn't been to look at a house whose numbers add up, but isn't right? Naming and measuring what's not right is harder initially, but could bring so much more to the comprehension and comparison process. Imagine avoiding arguements about choosing a house because you could explain (in a repeatable and comparable way) that the feel of the house was wrong, despite all the numbers adding up. I think it would be worthwhile, and much more meaningful.

End rant now.