better know math and statistics before diving in

I found this book enjoyable, but most of the math and statistics were way over my head.
Fortunately, I'm a general manager and I can hire folks to do the good things that this book lays out. Before listening to this book, our cybersecurity matrix was green, yellow, red. Now we can move toward continuous measurement, which makes more sense.

5 personnes ont trouvé cela utile

Not appropriate for audio, buy a hard copy instead

Would you try another book from Douglas W. Hubbard and Richard Seiersen and/or Patrick Cronin?

Yes, it was obvious that they knew their stuff

Any additional comments?

I liked this book, I wish I could return it for a hard copy. This book is well done but really hard to follow as an audio book, which is how I bought it. Audible says I can't return it.

9 personnes ont trouvé cela utile

Umm...not for audio

Great subject matter. Good read. Terrible book for audio. Need the hardcopy, otherwise just useless.

2 personnes ont trouvé cela utile

Great book to understand Cybersecurity Risk

Cybersecurity risk needs to adopt a quantitative risk metric driven approach. This book will help you understand why and walk you through some of the methods. It has a very applied hands on approach with links to downloadable spreadsheets.

2 personnes ont trouvé cela utile

Great book, horrible audio book

This book is packed full of graphs, images etc. it also has ALOT of equations. You need to see this to use this well. The audio book is painful . The real book is a great reference book to keep around.

Worth listening too

Why? Developing an IT Security budget is really hard, this is one of the few books I feel is worth reading in order to get a predictive sense of risk of occurrence against impact.

By estimating the potential occurrence of an event against the events business impact you can allocate funds against your estimates using a Bayesian statistical model.

The audible book is a fine listen, though the description of excel formulas feels odd (chuckle), that said the actual book does a great job of demonstrating both the "how" and "why" of the approach using clear practical examples with a great accompanying web-site.

Awesome Risk Analysis Methods

the hard part wad listening to math formulas being read. other than that, great! information.

Mixed feelings on this

Useless an audio book. Possibly better on paper.
I'm still curious, however listening to Excel formulas is unbearable and very much yesterday.

Cybersecurity risk measurement reimagined

Excellent rethinking of how to quantify and calculate real risks in Cybersecurity. This fresh, scientific, math-based approach to measuring and then calculating probabilities will allow realistic risk management of cybersecurity in corporations across all industries.

This is a substantial tome requiring a paper or text-based, electronic version to leverage all its usefulness. The book is split in three sections. First, a high-level explanation of the concepts and a vigorous rallying cry to abandon the ineffective, and often misleading, status quo of cybersecurity risk measurement. Second, a detailed explanation of the theories with many real world research examples to back them up. And, lastly, a deep dive into how to use the provided Microsoft Excel spreadsheet formulae to begin implementing the theory in a actual cybersecurity program.

The Audible version is well done, with the first two sections easy to follow and comprehend with only a few rewinds for grasping the intricacies of the theory. However, the third section is nearly impossible to follow audibly as the reader is required to voice long and complex Excel mathematical formulas. Of course, this is not a fault of the authors or the performance, just a result of the deep subject matter and detailed examples.

Yes, that's the problem. But what's the solution?

The author describes the problem well. But not the solution. Human threats defy measurement. To accomplish any kind of estimate, one needs to know the motives and methods of one's adversary. Without mindreading, one can only estimate - but never measure - risk. Patrick Bryant, CISSP, NASA infosec, retired