How to Measure Anything in Cybersecurity Risk

The cybersecurity profession is rich in data and the boardroom is desperate for meaningful risk analysis, but our traditional ways of communicating risk doesn't use the data and favors vague phrases to communicate the message. This book aims to remedy this problem and does so masterfully. Many readers will need to un-learn some habits in order to embrace risk measurement, but the authors make a solid case for why the traditional qualitative risk register isn't adequate for the modern landscape. I personally had to read some sections more than once, which is a complement to the authors. Some of the best books I read involve some struggle and "How to Measure Anything in Cybersecurity Risk" is easily among the top ten books in this profession I've read. I'll further add that I'm not often a five star sort of reviewer, thinking often the truth lies in middle but this book is the exception to the rule. If you work in cybersecurity and want to improve your decision making ability this book is for you.

I was hoping for some practical new ideas for methods of exploring and quantifying likelyhood and impact. This book provides a DEEP dive into Bayesian Statistical analysis, but it spends the first half of itself going into why it's needed and what is wrong with current subjective methods. I already knew what was wrong and why, that's why I bought the book. The techniques described will require a complete refit of what you are doing at a computational level, plus a complete mindshift away from normative practice. Disappointed ....

Muchas ideas de este libro por muy innovadoras que suenen no se desarrollan a una profundidad profesional. A veces el autor evita explicar tópicos esenciales que promete el libro porque sencillamente ni él mismo domina la materia o porque le interesa que muerdas el anzuelo de consultoría.

amazing book good seller must buy for risk management

One of the greatest books on this topic