How to Measure Anything in Cybersecurity Risk

By: Douglas W. Hubbard, Richard Seiersen

Narrated by: Patrick Cronin

A ground shaking exposé on the failure of popular cyber risk management methods.

How to Measure Anything in Cybersecurity Risk exposes the shortcomings of current "risk management" practices, and offers a series of improvement techniques that help you fill the holes and ramp up security. In his best-selling book How to Measure Anything, author Douglas W. Hubbard opened the business world's eyes to the critical need for better measurement. This book expands upon that premise and draws from The Failure of Risk Management to sound the alarm in the cybersecurity realm. Some of the field's premier risk management approaches actually create more risk than they mitigate, and questionable methods have been duplicated across industries and embedded in the products accepted as gospel. This book sheds light on these blatant risks and provides alternate techniques that can help improve your current situation. You'll also learn which approaches are too risky to save and are actually more damaging than a total lack of any security. Dangerous risk management methods abound; there is no industry more critically in need of solutions than cybersecurity. This book provides solutions where they exist, and advises when to change tracks entirely.

• Discover the shortcomings of cybersecurity's "best practices"
• Learn which risk management approaches actually create risk
• Improve your current practices with practical alterations
• Learn which methods are beyond saving, and worse than doing nothing

Insightful and enlightening, this book will inspire a closer examination of your company's own risk management practices in the context of cybersecurity. The end goal is airtight data protection, so finding cracks in the vault is a positive thing - as long as you get there before the bad guys do. How to Measure Anything in Cybersecurity Risk is your guide to more robust protection through better quantitative processes, approaches, and techniques.

Download the accompanying reference guide.©2016 John Wiley & Sons, Inc. (P)2016 Audible, Inc.

Masterful book, not ideal for audio

This book is an absolute must read for anyone responsible for cybersecurity risk. Hubbard makes complex concepts clear and understandable. I already had a copy on my Kindle and added the audio book so I could listen during my commute. I'm glad I did but found that I skipped through some parts that relied on a good look at the page. Formulas for statistical and probability calculations don't lend themselves to narration and I rely on the written copy for that. Nearly all of the audio book was captivating but for the few parts that have to be read, I'd suggest that another copy is needed to fully appreciate it.

Yes, that's the problem. But what's the solution?

The author describes the problem well. But not the solution. Human threats defy measurement. To accomplish any kind of estimate, one needs to know the motives and methods of one's adversary. Without mindreading, one can only estimate - but never measure - risk. Patrick Bryant, CISSP, NASA infosec, retired

Not for Audible

This book is not really suited for Audible. Listening to the narrator say excel formulae is not really great. I think the authors do have some good information, so the book is worth reading. BUY the physical or kindle book rather.

Amazon should consider an option to allow users to exchange an Audible book for a real version in this scenario.

Not appropriate for audio, buy a hard copy instead

Would you try another book from Douglas W. Hubbard and Richard Seiersen and/or Patrick Cronin?

Yes, it was obvious that they knew their stuff

Any additional comments?

I liked this book, I wish I could return it for a hard copy. This book is well done but really hard to follow as an audio book, which is how I bought it. Audible says I can't return it.

Informative

the data presented is relevant,but the lack of graphics makes keeping up difficult for someone not familiar with statistics and risk Management.

Great book

This was a great book to help put a lot of things into perspective for measuring risk. As someone who only listens to audio books while driving in the car, the math heavy chapters where of slightly less value as an audio book. That said, the content was solid enough that I will most likely be purchasing this book on Kindle to read again and make more use of the actual math side of it.

better know math and statistics before diving in

I found this book enjoyable, but most of the math and statistics were way over my head.
Fortunately, I'm a general manager and I can hire folks to do the good things that this book lays out. Before listening to this book, our cybersecurity matrix was green, yellow, red. Now we can move toward continuous measurement, which makes more sense.

Worth listening too

Why? Developing an IT Security budget is really hard, this is one of the few books I feel is worth reading in order to get a predictive sense of risk of occurrence against impact.

By estimating the potential occurrence of an event against the events business impact you can allocate funds against your estimates using a Bayesian statistical model.

The audible book is a fine listen, though the description of excel formulas feels odd (chuckle), that said the actual book does a great job of demonstrating both the "how" and "why" of the approach using clear practical examples with a great accompanying web-site.

Finally

I stare at qualitative values and draw blanks for how to measure. This has plagued me most of my career as a cyber professional. But now as an IT auditor, I’m even more dumbfounded of how we formulate probabilities from subjective values. This book has opened up a new perspectives for shifting subjective values to objective values for unbiased measurements. Understanding these formulas will better quantitative and even qualitative measurements. This stuff is what I needed.

Would be better without Narrating formulas

Overall this is a great cyber security book, which the field is greatly lacking. I learned a lot, and I would said overall this is worth a listen, if you are high enough up your company/organizations security team. That being said, there is room for improvement and some things to consider for potential listeners:

- I listen to audiobooks exclusively in the car, and therefor cannot reference figures/images from the book. There are a lot of them.

- The authors helpfully reference their parent website for downloadable content, then proceed to verbally narrate excel functions...often 2-3 minutes long. I had to 10-second skip over these more often than I would have liked.