How to Measure Anything in Cybersecurity Risk
by Douglas W. Hubbard, Richard Seiersen, Daniel E. Geer Jr., Stuart McClure, James Patrick Cronin · first published 2016
5mentions
3recommended by
4HN commenters
2022–2026first – last mentioned
75% recommend25% neutral
Affiliate links. As an Amazon Associate I earn from qualifying purchases.
…"quantitative" techniques is in applying risk management to threat models. But the way risk is managed in the industry (multiplying likelihood and impact) is completely incoherent and voodoo. See the book "How to Measure Anything in Cybersecurity Risk" [1] for a good explanation of why it doesn't work and better ways to do it. Which is a long way of saying, no, security doesn't use quantitative techniques mostly, but it would be possible if people…
on “Short session expiration does not help security” ↗It’s really not unquantifiable. I read “How to Measure Anything in Cybersecurity Risk” and it was an eye opener. Using a table of risks and outcomes with associated probabilities and 90% confidence intervals of dollar impacts we can quantify categories of technical debt.
on “A useful productivity measure?” ↗I recommend "How to measure anything in cybersecurity risk". Really interesting read about putting actual value on security.
on “Anthropic scales Claude Mythos to critical infrastructure in 15 countries” ↗It reminds me of "How to Measure Anything" by Douglas Hubbard [1] I read "How to Measure Anything in Cybersecurity Risk" but the relevant concepts are from his original book: - every measurement is an approximation - you can determine a more accurate valuation (or probability) by thinking in terms of bets The book isn't…
on “When negotiating a price, never bid with a round number (2016)” ↗What about the Bayesian methods shown in "How to Measure Anything"? They have been applied to Cybersecurity ("How to Measure Anything in Cybersecurity Risk" in a very thorough and convincing manner. It looks like the business around it is trying to apply it to product management (https://hubbardresearch.com/shop/measure-anything-project-ma...). Basically…
on “A useful productivity measure?” ↗