How predictable something is depends on what we are trying to predict, how far into the future, and under what circumstances.
—Philip Tetlock
“Essentially all models are wrong, but some are useful.”
—George Box
Overview
Out of all the capabilities in the infosec community that have improved over the years, the one essential skill that has barely moved forward is calculating cyber risk. Specifically, how do we convey cybersecurity risk to senior leadership and to the board?
In my early network defender days, whenever somebody asked me to do a risk assessment, I would punt. I would roll out my “qualitative heat map” (a fancy name for a color‐coded spreadsheet where all the risks are listed on the x‐axis and my three levels of potential impact—high, medium, and low—are plotted on the y‐axis) and call it a day (see Figure 6.1).1 Along with many of my peers, I would tell myself that predicting cyber risk with any more precision was impossible; that there were too many variables; that cybersecurity was somehow different from all other disciplines in the world; that it couldn't be done.
The Cybersecurity Canon Project is full of Hall of Fame and candidate books that talk about how to calculate cyber risk with precision.
How to Measure Anything in Cybersecurity Risk, by Douglas W. Hubbard ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month, and much more.
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.
Julian F.
Head of Cybersecurity
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.
Addison B.
Field Engineer
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.
Amir M.
Data Platform Tech Lead
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.
