How to Measure Anything in Cybersecurity Risk

I was assigned this as one of the texts for a graduate-level seminar in cybersecurity and cyberwarfare economic risk analysis. This book is remarkable in that it presents a clear framework for "non-mathies" to become statistically literate enough to debunk common misconceptions and move beyond the standard qualitative "stoplight chart" style risk matrix charts into true quantifiable probabilities. The authors hold the readers hand each step of the way, beginning with a simple 3-step process to easily replace the standard stoplight risk matrix with actual quantifiable numbers. Fundamental points made by the authors include: - Experts who claim some elements are purely qualitative and cannot be measured are simply wrong and haven't properly defined what they are trying to measure ye. - "We don't have enough information to measure this" is a statement that refutes itself, because it claims there IS some threshold of measurement beyond which it can be "measured" -- implying it can be measured now since it can be compared to that imaginary threshold. - Virtually everything we encounter in any situation has already been measured and has math models for predicting behavior, we just need to figure out what we are trying to measure and find the models for it. - Claiming "there aren't enough samples for statistical significance" shows the person doesn't understand statistics -- a LOT of useful info can be gleamed from very small samples, and all we need to do is REDUCE uncertainty to be useful, not eliminate it. The authors guide the read through the entire process of building a gut-level intuition for basic statistical and probabilistic thinking and modeling, allowing readers to immediately stop using vague "hi/med/low" assessments (that are just as full of errors as any mathematical formulation) and start using quantifiable predictions that can be easily improved as more information becomes available. A great leader once told me that we typically only have about 70% of the information we want to have when the time comes to make a decision. This book helps you increase that number before decision time runs out.

It was good

Read it and found some value but a little generic and simple. Still glad I read it

amazing book !!

It's essentially a rehash of his previous book. Not bad, but a rehash. That being said, the book is in my library and it does have useful new analytical material. Particularly good is the explanation of the notion that mostly everything is some measure of something. Case in point: in a recent meeting I asked my colleagues to rate something Low Mod High. Someone objected that that was 'so subjective'. My reply was Yes, but at least we will know what people think subjectively, and also - you know - we can train to be better estimators...it's in the book and that's a major contribution. So, like I wrote to Mr. Hubbard when he rightly pushed back on my original 3 stars / re-hash but good review, he's correct: the book has a lot more than just a rehash; I stand corrected.