How to Measure Anything in Cybersecurity Risk, 2nd Edition

Index

• Page numbers followed by f and t refer to figures and tables, respectively.

• Absurdity test, 166, 170
• Accumulating snapshots, 273–274, 274f
• Adobe security breach, 14, 147–150, 149t, 319
• Adult Friend Finder, 319
• Advanced data stealing threats (ADST), 269–272, 269f, 270t–272t, 272f
• Advisen LTD, 52, 223, 224
• AEL, see Annual expected losses
• AIR Worldwide, 323–325
• Algorithms:
  • to average expert estimates, 217
  • expert judgments vs., 79–84
  • performance of, 179
  • tolerance of errors from, 118–119
• Algorithm Aversion, 118–119
• AllClear ID, 201–202
• Alpha parameter, 195–197, 196f, 197f, 200
• Amazon, 263
• American Statistical Association, 33
• The American Statistician, 33
• Amplifying effects, with risk matrix, 114–117, 116f
• Analysis placebo, 75–77
• Analytics technology, 258, 280
• Anchoring, 90, 166, 170
• Andreassen, Paul, 76
• Anecdotal evidence, 126–127
• Annual expected losses (AEL):
  • calculating, 55
  • in rapid risk model, 47, 50
  • using ranges and probabilities to represent, 55–64 (See also Monte Carlo simulation)
• Anonymous, 143
• Anthem security breach, 11, 147, 319
• Antivirus definitions, 253
• Aon, 125
• Apache Superset, 263
• Application‐based decomposition, 138
• Armstrong, J. Scott, 94–95, 140
• Arrival baselines, 240–245, 241f–244f
• Arrival rates, 240
• Ashley Madison, 319
• Assets, 44, 46
• Assumptions, 169
• Attack surface, 10–12
• Attitudes Toward Quantitative Methods (ATQM) survey, 102–103, 102t
• Audits, 281–284. See also Rapid risk audit

• Baselines. See also BOOM (baseline objectives and optimization ...