Measuring and Managing Information Risk

What Hacker News says

1. beardedwizardApr 2020
   I highly recommend reading ETS, then 'Measuring and managing information risk', both talk extensively about this. Magoo has written quite a bit as well.

   I really appreciate the mission support oriented perspective in ETS, something a lot of security practitioners could learn from.

   thread
2. jacques_chesterMar 2020
   The relevant book for this is Measuring and Managing Information Risk: A FAIR Approach by Freund and Jones[0].

   Both books are worth reading; Hubbard's influence on FAIR is noticeable and positive. FAIR has the advantage that it comes with a fairly built-out ontology for assembling data or estimates. The OP touches on the top level (Loss Event Magnitude and Loss Event Frequency), but the ontology goes quite deep and can be used at multiple levels of detail.

   The calculations are not difficult, I've implemented them twice in proofs-of-concept, including one that produces pretty charts.

   The difficult part, to be honest, is that developing good estimates is difficult and frequently uncomfortable and the gains are not easily internalised.

   Additionally, serious tool support is lacking in the places where it would make a difference -- issue trackers, for example.

   [0] https://www.amazon.com/Measuring-Managing-Information-Risk-A...

   edit -- Another good book in this area is Waltzing with Bears by DeMarco & Lister. A short, funny, insightful read, as you'd expect from the authors of PeopleWare: https://www.amazon.com/Waltzing-Bears-Managing-Software-Proj...

   Show morethread
3. TeMPOraLNov 2018
   Quoting from a book on information risk[0] I'm reading:

   "... we have to remember how this form of loss [reputation damage] typically materializes for a commercial company - reduced market share, reduced stock price (if publicly traded), increased cost of capital, and increased cost of acquiring and retaining employees."

   Iff we want Google to change, we should figure out a way to translate moral outrage into threatening some of the things mentioned in the quote.

   --

   [0] -- Measuring and Managing Information Risk: A FAIR Approach 1st Edition, p. 138.

   Show morethread