How to measure anything in cybersecurity risk:
Gespeichert in:
| Beteiligte Personen: | , |
|---|---|
| Format: | Buch |
| Sprache: | Englisch |
| Veröffentlicht: |
Hoboken, New Jersey
Wiley
[2023]
|
| Ausgabe: | second edition |
| Schlagwörter: | |
| Umfang: | xv, 345 Seiten Illustrationen |
| ISBN: | 9781119892304 |
Internformat
MARC
| LEADER | 00000nam a2200000zc 4500 | ||
|---|---|---|---|
| 001 | BV049422715 | ||
| 003 | DE-604 | ||
| 005 | 20240209 | ||
| 007 | t| | ||
| 008 | 231120s2023 xx a||| |||| 00||| eng d | ||
| 020 | |a 9781119892304 |c hbk |9 978-1-119-89230-4 | ||
| 035 | |a (OCoLC)1393240248 | ||
| 035 | |a (DE-599)BVBBV049422715 | ||
| 040 | |a DE-604 |b ger |e rda | ||
| 041 | 0 | |a eng | |
| 049 | |a DE-384 |a DE-M347 |a DE-N2 | ||
| 082 | 0 | |a 658.478 | |
| 084 | |a ST 277 |0 (DE-625)143643: |2 rvk | ||
| 100 | 1 | |a Hubbard, Douglas W. |d 1962- |e Verfasser |0 (DE-588)173955398 |4 aut | |
| 245 | 1 | 0 | |a How to measure anything in cybersecurity risk |c Douglas W. Hubbard, Richard Seiersen |
| 250 | |a second edition | ||
| 264 | 1 | |a Hoboken, New Jersey |b Wiley |c [2023] | |
| 264 | 4 | |c ©2023 | |
| 300 | |a xv, 345 Seiten |b Illustrationen | ||
| 336 | |b txt |2 rdacontent | ||
| 337 | |b n |2 rdamedia | ||
| 338 | |b nc |2 rdacarrier | ||
| 505 | 8 | |a Cover -- Title Page -- Copyright Page -- Contents -- Foreword for the Second Edition -- Acknowledgments -- Preface -- How to Measure Anything in Cybersecurity Risk -- Introduction -- Why We Chose This Topic -- What Is This Book About? -- We Need More Than Technology -- Part I Why Cybersecurity Needs Better Measurements for Risk -- Chapter 1 The One Patch Most Needed in Cybersecurity -- Insurance: A Canary in the Coal Mine -- The Global Attack Surface -- The Cyber Threat Response -- A Proposal for Cybersecurity Risk Management -- Notes -- Chapter 2 A Measurement Primer for Cybersecurity -- The Concept of Measurement -- A Taxonomy of Measurement Scales -- The Object of Measurement -- The Methods of Measurement -- Notes -- Chapter 3 The Rapid Risk Audit: Starting With a Simple Quantitative Risk Model -- The Setup and Terminology -- The Rapid Audit Steps -- Some Initial Sources of Data -- The Expert as the Instrument -- Supporting the Decision: Return on Controls -- Doing "Uncertainty Math" -- Visualizing Risk With a Loss Exceedance Curve -- Where to Go from Here -- Notes -- Chapter 4 The Single Most Important Measurement in Cybersecurity -- The Analysis Placebo: Why We Can't Trust Opinion Alone -- How You Have More Data than You Think -- When Algorithms Beat Experts -- Tools for Improving the Human Component -- Summary and Next Steps -- Notes -- Chapter 5 Risk Matrices, Lie Factors, Misconceptions, and Other Obstacles to Measuring Risk -- Scanning the Landscape: A Survey of Cybersecurity Professionals -- What Color Is Your Risk? The Ubiquitous-and Risky-Risk Matrix -- Exsupero Ursus and Other Fallacies -- Communication and Consensus Objections -- Conclusion -- Notes -- Part II Evolving the Model of Cybersecurity Risk -- Chapter 6 Decompose It: Unpacking the Details -- Decomposing the Simple One-for-One Substitution Model | |
| 505 | 8 | |a More Decomposition Guidelines: Clear, Observable, Useful -- A Hard Decomposition: Reputation Damage -- Conclusion -- Notes -- Chapter 7 Calibrated Estimates: How Much Do You Know Now? -- Introduction to Subjective Probability -- Calibration Exercise -- More Hints for Controlling Overconfidence -- Conceptual Obstacles to Calibration -- The Effects of Calibration -- Beyond Initial Calibration Training: More Methods for Improving Subjective Judgment -- Notes -- Answers to Trivia Questions for Calibration Exercise -- Chapter 8 Reducing Uncertainty with Bayesian Methods -- A Brief Introduction to Bayes and Probability Theory -- An Example from Little Data: Does Multifactor Authentication Work? -- Other Ways Bayes Applies -- Notes -- Chapter 9 Some Powerful Methods Based on Bayes -- Computing Frequencies with (Very) Few Data Points: The Beta Distribution -- Decomposing Probabilities with Many Conditions -- Reducing Uncertainty Further and When to Do It -- More Advanced Modeling Considerations -- Wrapping Up Bayes -- Notes -- Part III Cybersecurity Risk Management for the Enterprise -- Chapter 10 Toward Security Metrics Maturity -- Introduction: Operational Security Metrics Maturity Model -- Sparse Data Analytics -- Functional Security Metrics -- Functional Security Metrics Applied: BOOM! -- Wait-Time Baselines -- Security Data Marts -- Prescriptive Analytics -- Notes -- Chapter 11 How Well Are My Security Investments Working Together? -- Security Metrics with the Modern Data Stack -- Modeling for Security Business Intelligence -- Addressing BI Concerns -- Just the Facts: What Is Dimensional Modeling, and Why Do I Need It? -- Dimensional Modeling Use Case: Advanced Data Stealing Threats -- Modeling People Processes -- Conclusion -- Notes -- Chapter 12 A Call to Action: How to Roll Out Cybersecurity Risk Management -- Establishing the CSRM Strategic Charter | |
| 505 | 8 | |a Organizational Roles and Responsibilities for CSRM -- Getting Audit to Audit -- What the Cybersecurity Ecosystem Must Do to Support You -- Integrating CSRM with the Rest of the Enterprise -- Can We Avoid the Big One? -- Appendix A Selected Distributions -- Distribution Name: Triangular -- Distribution Name: Binary -- Distribution Name: Normal -- Distribution Name: Lognormal -- Distribution Name: Beta -- Distribution Name: Power Law -- Appendix B Guest Contributors -- Decision Analysis to Support Ransomware Cybersecurity Risk Management -- Bayesian Networks: One Solution for Specific Challenges in Building ML Systems in Cybersecurity -- The Flaw of Averages in Cyber Security -- Botnets -- Password Hacking -- How Catastrophe Modeling Can Be Applied to Cyber Risk -- Notes -- Index -- EULA. | |
| 650 | 0 | 7 | |a Quantitative Methode |0 (DE-588)4232139-6 |2 gnd |9 rswk-swf |
| 650 | 0 | 7 | |a Cyberspace |0 (DE-588)4266146-8 |2 gnd |9 rswk-swf |
| 650 | 0 | 7 | |a Risikomanagement |0 (DE-588)4121590-4 |2 gnd |9 rswk-swf |
| 650 | 0 | 7 | |a Sicherheit |0 (DE-588)4054790-5 |2 gnd |9 rswk-swf |
| 689 | 0 | 0 | |a Cyberspace |0 (DE-588)4266146-8 |D s |
| 689 | 0 | 1 | |a Sicherheit |0 (DE-588)4054790-5 |D s |
| 689 | 0 | 2 | |a Risikomanagement |0 (DE-588)4121590-4 |D s |
| 689 | 0 | 3 | |a Quantitative Methode |0 (DE-588)4232139-6 |D s |
| 689 | 0 | |5 DE-604 | |
| 700 | 1 | |a Seiersen, Richard |d 1967- |e Verfasser |0 (DE-588)1246094789 |4 aut | |
| 776 | 0 | 8 | |i Erscheint auch als |n Online-Ausgabe, PDF |z 978-1-119-89232-8 |
| 776 | 0 | 8 | |i Erscheint auch als |n Online-Ausgabe, EPUB |z 978-1-119-89231-1 |
| 943 | 1 | |a oai:aleph.bib-bvb.de:BVB01-034750194 | |
Datensatz im Suchindex
| _version_ | 1818991523170091008 |
|---|---|
| any_adam_object | |
| author | Hubbard, Douglas W. 1962- Seiersen, Richard 1967- |
| author_GND | (DE-588)173955398 (DE-588)1246094789 |
| author_facet | Hubbard, Douglas W. 1962- Seiersen, Richard 1967- |
| author_role | aut aut |
| author_sort | Hubbard, Douglas W. 1962- |
| author_variant | d w h dw dwh r s rs |
| building | Verbundindex |
| bvnumber | BV049422715 |
| classification_rvk | ST 277 |
| contents | Cover -- Title Page -- Copyright Page -- Contents -- Foreword for the Second Edition -- Acknowledgments -- Preface -- How to Measure Anything in Cybersecurity Risk -- Introduction -- Why We Chose This Topic -- What Is This Book About? -- We Need More Than Technology -- Part I Why Cybersecurity Needs Better Measurements for Risk -- Chapter 1 The One Patch Most Needed in Cybersecurity -- Insurance: A Canary in the Coal Mine -- The Global Attack Surface -- The Cyber Threat Response -- A Proposal for Cybersecurity Risk Management -- Notes -- Chapter 2 A Measurement Primer for Cybersecurity -- The Concept of Measurement -- A Taxonomy of Measurement Scales -- The Object of Measurement -- The Methods of Measurement -- Notes -- Chapter 3 The Rapid Risk Audit: Starting With a Simple Quantitative Risk Model -- The Setup and Terminology -- The Rapid Audit Steps -- Some Initial Sources of Data -- The Expert as the Instrument -- Supporting the Decision: Return on Controls -- Doing "Uncertainty Math" -- Visualizing Risk With a Loss Exceedance Curve -- Where to Go from Here -- Notes -- Chapter 4 The Single Most Important Measurement in Cybersecurity -- The Analysis Placebo: Why We Can't Trust Opinion Alone -- How You Have More Data than You Think -- When Algorithms Beat Experts -- Tools for Improving the Human Component -- Summary and Next Steps -- Notes -- Chapter 5 Risk Matrices, Lie Factors, Misconceptions, and Other Obstacles to Measuring Risk -- Scanning the Landscape: A Survey of Cybersecurity Professionals -- What Color Is Your Risk? The Ubiquitous-and Risky-Risk Matrix -- Exsupero Ursus and Other Fallacies -- Communication and Consensus Objections -- Conclusion -- Notes -- Part II Evolving the Model of Cybersecurity Risk -- Chapter 6 Decompose It: Unpacking the Details -- Decomposing the Simple One-for-One Substitution Model More Decomposition Guidelines: Clear, Observable, Useful -- A Hard Decomposition: Reputation Damage -- Conclusion -- Notes -- Chapter 7 Calibrated Estimates: How Much Do You Know Now? -- Introduction to Subjective Probability -- Calibration Exercise -- More Hints for Controlling Overconfidence -- Conceptual Obstacles to Calibration -- The Effects of Calibration -- Beyond Initial Calibration Training: More Methods for Improving Subjective Judgment -- Notes -- Answers to Trivia Questions for Calibration Exercise -- Chapter 8 Reducing Uncertainty with Bayesian Methods -- A Brief Introduction to Bayes and Probability Theory -- An Example from Little Data: Does Multifactor Authentication Work? -- Other Ways Bayes Applies -- Notes -- Chapter 9 Some Powerful Methods Based on Bayes -- Computing Frequencies with (Very) Few Data Points: The Beta Distribution -- Decomposing Probabilities with Many Conditions -- Reducing Uncertainty Further and When to Do It -- More Advanced Modeling Considerations -- Wrapping Up Bayes -- Notes -- Part III Cybersecurity Risk Management for the Enterprise -- Chapter 10 Toward Security Metrics Maturity -- Introduction: Operational Security Metrics Maturity Model -- Sparse Data Analytics -- Functional Security Metrics -- Functional Security Metrics Applied: BOOM! -- Wait-Time Baselines -- Security Data Marts -- Prescriptive Analytics -- Notes -- Chapter 11 How Well Are My Security Investments Working Together? -- Security Metrics with the Modern Data Stack -- Modeling for Security Business Intelligence -- Addressing BI Concerns -- Just the Facts: What Is Dimensional Modeling, and Why Do I Need It? -- Dimensional Modeling Use Case: Advanced Data Stealing Threats -- Modeling People Processes -- Conclusion -- Notes -- Chapter 12 A Call to Action: How to Roll Out Cybersecurity Risk Management -- Establishing the CSRM Strategic Charter Organizational Roles and Responsibilities for CSRM -- Getting Audit to Audit -- What the Cybersecurity Ecosystem Must Do to Support You -- Integrating CSRM with the Rest of the Enterprise -- Can We Avoid the Big One? -- Appendix A Selected Distributions -- Distribution Name: Triangular -- Distribution Name: Binary -- Distribution Name: Normal -- Distribution Name: Lognormal -- Distribution Name: Beta -- Distribution Name: Power Law -- Appendix B Guest Contributors -- Decision Analysis to Support Ransomware Cybersecurity Risk Management -- Bayesian Networks: One Solution for Specific Challenges in Building ML Systems in Cybersecurity -- The Flaw of Averages in Cyber Security -- Botnets -- Password Hacking -- How Catastrophe Modeling Can Be Applied to Cyber Risk -- Notes -- Index -- EULA. |
| ctrlnum | (OCoLC)1393240248 (DE-599)BVBBV049422715 |
| dewey-full | 658.478 |
| dewey-hundreds | 600 - Technology (Applied sciences) |
| dewey-ones | 658 - General management |
| dewey-raw | 658.478 |
| dewey-search | 658.478 |
| dewey-sort | 3658.478 |
| dewey-tens | 650 - Management and auxiliary services |
| discipline | Informatik Wirtschaftswissenschaften |
| edition | second edition |
| format | Book |
| fullrecord | <?xml version="1.0" encoding="UTF-8"?><collection xmlns="http://www.loc.gov/MARC21/slim"><record><leader>06299nam a2200481zc 4500</leader><controlfield tag="001">BV049422715</controlfield><controlfield tag="003">DE-604</controlfield><controlfield tag="005">20240209 </controlfield><controlfield tag="007">t|</controlfield><controlfield tag="008">231120s2023 xx a||| |||| 00||| eng d</controlfield><datafield tag="020" ind1=" " ind2=" "><subfield code="a">9781119892304</subfield><subfield code="c">hbk</subfield><subfield code="9">978-1-119-89230-4</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(OCoLC)1393240248</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(DE-599)BVBBV049422715</subfield></datafield><datafield tag="040" ind1=" " ind2=" "><subfield code="a">DE-604</subfield><subfield code="b">ger</subfield><subfield code="e">rda</subfield></datafield><datafield tag="041" ind1="0" ind2=" "><subfield code="a">eng</subfield></datafield><datafield tag="049" ind1=" " ind2=" "><subfield code="a">DE-384</subfield><subfield code="a">DE-M347</subfield><subfield code="a">DE-N2</subfield></datafield><datafield tag="082" ind1="0" ind2=" "><subfield code="a">658.478</subfield></datafield><datafield tag="084" ind1=" " ind2=" "><subfield code="a">ST 277</subfield><subfield code="0">(DE-625)143643:</subfield><subfield code="2">rvk</subfield></datafield><datafield tag="100" ind1="1" ind2=" "><subfield code="a">Hubbard, Douglas W.</subfield><subfield code="d">1962-</subfield><subfield code="e">Verfasser</subfield><subfield code="0">(DE-588)173955398</subfield><subfield code="4">aut</subfield></datafield><datafield tag="245" ind1="1" ind2="0"><subfield code="a">How to measure anything in cybersecurity risk</subfield><subfield code="c">Douglas W. Hubbard, Richard Seiersen</subfield></datafield><datafield tag="250" ind1=" " ind2=" "><subfield code="a">second edition</subfield></datafield><datafield tag="264" ind1=" " ind2="1"><subfield code="a">Hoboken, New Jersey</subfield><subfield code="b">Wiley</subfield><subfield code="c">[2023]</subfield></datafield><datafield tag="264" ind1=" " ind2="4"><subfield code="c">©2023</subfield></datafield><datafield tag="300" ind1=" " ind2=" "><subfield code="a">xv, 345 Seiten</subfield><subfield code="b">Illustrationen</subfield></datafield><datafield tag="336" ind1=" " ind2=" "><subfield code="b">txt</subfield><subfield code="2">rdacontent</subfield></datafield><datafield tag="337" ind1=" " ind2=" "><subfield code="b">n</subfield><subfield code="2">rdamedia</subfield></datafield><datafield tag="338" ind1=" " ind2=" "><subfield code="b">nc</subfield><subfield code="2">rdacarrier</subfield></datafield><datafield tag="505" ind1="8" ind2=" "><subfield code="a">Cover -- Title Page -- Copyright Page -- Contents -- Foreword for the Second Edition -- Acknowledgments -- Preface -- How to Measure Anything in Cybersecurity Risk -- Introduction -- Why We Chose This Topic -- What Is This Book About? -- We Need More Than Technology -- Part I Why Cybersecurity Needs Better Measurements for Risk -- Chapter 1 The One Patch Most Needed in Cybersecurity -- Insurance: A Canary in the Coal Mine -- The Global Attack Surface -- The Cyber Threat Response -- A Proposal for Cybersecurity Risk Management -- Notes -- Chapter 2 A Measurement Primer for Cybersecurity -- The Concept of Measurement -- A Taxonomy of Measurement Scales -- The Object of Measurement -- The Methods of Measurement -- Notes -- Chapter 3 The Rapid Risk Audit: Starting With a Simple Quantitative Risk Model -- The Setup and Terminology -- The Rapid Audit Steps -- Some Initial Sources of Data -- The Expert as the Instrument -- Supporting the Decision: Return on Controls -- Doing "Uncertainty Math" -- Visualizing Risk With a Loss Exceedance Curve -- Where to Go from Here -- Notes -- Chapter 4 The Single Most Important Measurement in Cybersecurity -- The Analysis Placebo: Why We Can't Trust Opinion Alone -- How You Have More Data than You Think -- When Algorithms Beat Experts -- Tools for Improving the Human Component -- Summary and Next Steps -- Notes -- Chapter 5 Risk Matrices, Lie Factors, Misconceptions, and Other Obstacles to Measuring Risk -- Scanning the Landscape: A Survey of Cybersecurity Professionals -- What Color Is Your Risk? The Ubiquitous-and Risky-Risk Matrix -- Exsupero Ursus and Other Fallacies -- Communication and Consensus Objections -- Conclusion -- Notes -- Part II Evolving the Model of Cybersecurity Risk -- Chapter 6 Decompose It: Unpacking the Details -- Decomposing the Simple One-for-One Substitution Model</subfield></datafield><datafield tag="505" ind1="8" ind2=" "><subfield code="a">More Decomposition Guidelines: Clear, Observable, Useful -- A Hard Decomposition: Reputation Damage -- Conclusion -- Notes -- Chapter 7 Calibrated Estimates: How Much Do You Know Now? -- Introduction to Subjective Probability -- Calibration Exercise -- More Hints for Controlling Overconfidence -- Conceptual Obstacles to Calibration -- The Effects of Calibration -- Beyond Initial Calibration Training: More Methods for Improving Subjective Judgment -- Notes -- Answers to Trivia Questions for Calibration Exercise -- Chapter 8 Reducing Uncertainty with Bayesian Methods -- A Brief Introduction to Bayes and Probability Theory -- An Example from Little Data: Does Multifactor Authentication Work? -- Other Ways Bayes Applies -- Notes -- Chapter 9 Some Powerful Methods Based on Bayes -- Computing Frequencies with (Very) Few Data Points: The Beta Distribution -- Decomposing Probabilities with Many Conditions -- Reducing Uncertainty Further and When to Do It -- More Advanced Modeling Considerations -- Wrapping Up Bayes -- Notes -- Part III Cybersecurity Risk Management for the Enterprise -- Chapter 10 Toward Security Metrics Maturity -- Introduction: Operational Security Metrics Maturity Model -- Sparse Data Analytics -- Functional Security Metrics -- Functional Security Metrics Applied: BOOM! -- Wait-Time Baselines -- Security Data Marts -- Prescriptive Analytics -- Notes -- Chapter 11 How Well Are My Security Investments Working Together? -- Security Metrics with the Modern Data Stack -- Modeling for Security Business Intelligence -- Addressing BI Concerns -- Just the Facts: What Is Dimensional Modeling, and Why Do I Need It? -- Dimensional Modeling Use Case: Advanced Data Stealing Threats -- Modeling People Processes -- Conclusion -- Notes -- Chapter 12 A Call to Action: How to Roll Out Cybersecurity Risk Management -- Establishing the CSRM Strategic Charter</subfield></datafield><datafield tag="505" ind1="8" ind2=" "><subfield code="a">Organizational Roles and Responsibilities for CSRM -- Getting Audit to Audit -- What the Cybersecurity Ecosystem Must Do to Support You -- Integrating CSRM with the Rest of the Enterprise -- Can We Avoid the Big One? -- Appendix A Selected Distributions -- Distribution Name: Triangular -- Distribution Name: Binary -- Distribution Name: Normal -- Distribution Name: Lognormal -- Distribution Name: Beta -- Distribution Name: Power Law -- Appendix B Guest Contributors -- Decision Analysis to Support Ransomware Cybersecurity Risk Management -- Bayesian Networks: One Solution for Specific Challenges in Building ML Systems in Cybersecurity -- The Flaw of Averages in Cyber Security -- Botnets -- Password Hacking -- How Catastrophe Modeling Can Be Applied to Cyber Risk -- Notes -- Index -- EULA.</subfield></datafield><datafield tag="650" ind1="0" ind2="7"><subfield code="a">Quantitative Methode</subfield><subfield code="0">(DE-588)4232139-6</subfield><subfield code="2">gnd</subfield><subfield code="9">rswk-swf</subfield></datafield><datafield tag="650" ind1="0" ind2="7"><subfield code="a">Cyberspace</subfield><subfield code="0">(DE-588)4266146-8</subfield><subfield code="2">gnd</subfield><subfield code="9">rswk-swf</subfield></datafield><datafield tag="650" ind1="0" ind2="7"><subfield code="a">Risikomanagement</subfield><subfield code="0">(DE-588)4121590-4</subfield><subfield code="2">gnd</subfield><subfield code="9">rswk-swf</subfield></datafield><datafield tag="650" ind1="0" ind2="7"><subfield code="a">Sicherheit</subfield><subfield code="0">(DE-588)4054790-5</subfield><subfield code="2">gnd</subfield><subfield code="9">rswk-swf</subfield></datafield><datafield tag="689" ind1="0" ind2="0"><subfield code="a">Cyberspace</subfield><subfield code="0">(DE-588)4266146-8</subfield><subfield code="D">s</subfield></datafield><datafield tag="689" ind1="0" ind2="1"><subfield code="a">Sicherheit</subfield><subfield code="0">(DE-588)4054790-5</subfield><subfield code="D">s</subfield></datafield><datafield tag="689" ind1="0" ind2="2"><subfield code="a">Risikomanagement</subfield><subfield code="0">(DE-588)4121590-4</subfield><subfield code="D">s</subfield></datafield><datafield tag="689" ind1="0" ind2="3"><subfield code="a">Quantitative Methode</subfield><subfield code="0">(DE-588)4232139-6</subfield><subfield code="D">s</subfield></datafield><datafield tag="689" ind1="0" ind2=" "><subfield code="5">DE-604</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Seiersen, Richard</subfield><subfield code="d">1967-</subfield><subfield code="e">Verfasser</subfield><subfield code="0">(DE-588)1246094789</subfield><subfield code="4">aut</subfield></datafield><datafield tag="776" ind1="0" ind2="8"><subfield code="i">Erscheint auch als</subfield><subfield code="n">Online-Ausgabe, PDF</subfield><subfield code="z">978-1-119-89232-8</subfield></datafield><datafield tag="776" ind1="0" ind2="8"><subfield code="i">Erscheint auch als</subfield><subfield code="n">Online-Ausgabe, EPUB</subfield><subfield code="z">978-1-119-89231-1</subfield></datafield><datafield tag="943" ind1="1" ind2=" "><subfield code="a">oai:aleph.bib-bvb.de:BVB01-034750194</subfield></datafield></record></collection> |
| id | DE-604.BV049422715 |
| illustrated | Illustrated |
| indexdate | 2024-12-20T20:11:37Z |
| institution | BVB |
| isbn | 9781119892304 |
| language | English |
| oai_aleph_id | oai:aleph.bib-bvb.de:BVB01-034750194 |
| oclc_num | 1393240248 |
| open_access_boolean | |
| owner | DE-384 DE-M347 DE-N2 |
| owner_facet | DE-384 DE-M347 DE-N2 |
| physical | xv, 345 Seiten Illustrationen |
| publishDate | 2023 |
| publishDateSearch | 2023 |
| publishDateSort | 2023 |
| publisher | Wiley |
| record_format | marc |
| spelling | Hubbard, Douglas W. 1962- Verfasser (DE-588)173955398 aut How to measure anything in cybersecurity risk Douglas W. Hubbard, Richard Seiersen second edition Hoboken, New Jersey Wiley [2023] ©2023 xv, 345 Seiten Illustrationen txt rdacontent n rdamedia nc rdacarrier Cover -- Title Page -- Copyright Page -- Contents -- Foreword for the Second Edition -- Acknowledgments -- Preface -- How to Measure Anything in Cybersecurity Risk -- Introduction -- Why We Chose This Topic -- What Is This Book About? -- We Need More Than Technology -- Part I Why Cybersecurity Needs Better Measurements for Risk -- Chapter 1 The One Patch Most Needed in Cybersecurity -- Insurance: A Canary in the Coal Mine -- The Global Attack Surface -- The Cyber Threat Response -- A Proposal for Cybersecurity Risk Management -- Notes -- Chapter 2 A Measurement Primer for Cybersecurity -- The Concept of Measurement -- A Taxonomy of Measurement Scales -- The Object of Measurement -- The Methods of Measurement -- Notes -- Chapter 3 The Rapid Risk Audit: Starting With a Simple Quantitative Risk Model -- The Setup and Terminology -- The Rapid Audit Steps -- Some Initial Sources of Data -- The Expert as the Instrument -- Supporting the Decision: Return on Controls -- Doing "Uncertainty Math" -- Visualizing Risk With a Loss Exceedance Curve -- Where to Go from Here -- Notes -- Chapter 4 The Single Most Important Measurement in Cybersecurity -- The Analysis Placebo: Why We Can't Trust Opinion Alone -- How You Have More Data than You Think -- When Algorithms Beat Experts -- Tools for Improving the Human Component -- Summary and Next Steps -- Notes -- Chapter 5 Risk Matrices, Lie Factors, Misconceptions, and Other Obstacles to Measuring Risk -- Scanning the Landscape: A Survey of Cybersecurity Professionals -- What Color Is Your Risk? The Ubiquitous-and Risky-Risk Matrix -- Exsupero Ursus and Other Fallacies -- Communication and Consensus Objections -- Conclusion -- Notes -- Part II Evolving the Model of Cybersecurity Risk -- Chapter 6 Decompose It: Unpacking the Details -- Decomposing the Simple One-for-One Substitution Model More Decomposition Guidelines: Clear, Observable, Useful -- A Hard Decomposition: Reputation Damage -- Conclusion -- Notes -- Chapter 7 Calibrated Estimates: How Much Do You Know Now? -- Introduction to Subjective Probability -- Calibration Exercise -- More Hints for Controlling Overconfidence -- Conceptual Obstacles to Calibration -- The Effects of Calibration -- Beyond Initial Calibration Training: More Methods for Improving Subjective Judgment -- Notes -- Answers to Trivia Questions for Calibration Exercise -- Chapter 8 Reducing Uncertainty with Bayesian Methods -- A Brief Introduction to Bayes and Probability Theory -- An Example from Little Data: Does Multifactor Authentication Work? -- Other Ways Bayes Applies -- Notes -- Chapter 9 Some Powerful Methods Based on Bayes -- Computing Frequencies with (Very) Few Data Points: The Beta Distribution -- Decomposing Probabilities with Many Conditions -- Reducing Uncertainty Further and When to Do It -- More Advanced Modeling Considerations -- Wrapping Up Bayes -- Notes -- Part III Cybersecurity Risk Management for the Enterprise -- Chapter 10 Toward Security Metrics Maturity -- Introduction: Operational Security Metrics Maturity Model -- Sparse Data Analytics -- Functional Security Metrics -- Functional Security Metrics Applied: BOOM! -- Wait-Time Baselines -- Security Data Marts -- Prescriptive Analytics -- Notes -- Chapter 11 How Well Are My Security Investments Working Together? -- Security Metrics with the Modern Data Stack -- Modeling for Security Business Intelligence -- Addressing BI Concerns -- Just the Facts: What Is Dimensional Modeling, and Why Do I Need It? -- Dimensional Modeling Use Case: Advanced Data Stealing Threats -- Modeling People Processes -- Conclusion -- Notes -- Chapter 12 A Call to Action: How to Roll Out Cybersecurity Risk Management -- Establishing the CSRM Strategic Charter Organizational Roles and Responsibilities for CSRM -- Getting Audit to Audit -- What the Cybersecurity Ecosystem Must Do to Support You -- Integrating CSRM with the Rest of the Enterprise -- Can We Avoid the Big One? -- Appendix A Selected Distributions -- Distribution Name: Triangular -- Distribution Name: Binary -- Distribution Name: Normal -- Distribution Name: Lognormal -- Distribution Name: Beta -- Distribution Name: Power Law -- Appendix B Guest Contributors -- Decision Analysis to Support Ransomware Cybersecurity Risk Management -- Bayesian Networks: One Solution for Specific Challenges in Building ML Systems in Cybersecurity -- The Flaw of Averages in Cyber Security -- Botnets -- Password Hacking -- How Catastrophe Modeling Can Be Applied to Cyber Risk -- Notes -- Index -- EULA. Quantitative Methode (DE-588)4232139-6 gnd rswk-swf Cyberspace (DE-588)4266146-8 gnd rswk-swf Risikomanagement (DE-588)4121590-4 gnd rswk-swf Sicherheit (DE-588)4054790-5 gnd rswk-swf Cyberspace (DE-588)4266146-8 s Sicherheit (DE-588)4054790-5 s Risikomanagement (DE-588)4121590-4 s Quantitative Methode (DE-588)4232139-6 s DE-604 Seiersen, Richard 1967- Verfasser (DE-588)1246094789 aut Erscheint auch als Online-Ausgabe, PDF 978-1-119-89232-8 Erscheint auch als Online-Ausgabe, EPUB 978-1-119-89231-1 |
| spellingShingle | Hubbard, Douglas W. 1962- Seiersen, Richard 1967- How to measure anything in cybersecurity risk Cover -- Title Page -- Copyright Page -- Contents -- Foreword for the Second Edition -- Acknowledgments -- Preface -- How to Measure Anything in Cybersecurity Risk -- Introduction -- Why We Chose This Topic -- What Is This Book About? -- We Need More Than Technology -- Part I Why Cybersecurity Needs Better Measurements for Risk -- Chapter 1 The One Patch Most Needed in Cybersecurity -- Insurance: A Canary in the Coal Mine -- The Global Attack Surface -- The Cyber Threat Response -- A Proposal for Cybersecurity Risk Management -- Notes -- Chapter 2 A Measurement Primer for Cybersecurity -- The Concept of Measurement -- A Taxonomy of Measurement Scales -- The Object of Measurement -- The Methods of Measurement -- Notes -- Chapter 3 The Rapid Risk Audit: Starting With a Simple Quantitative Risk Model -- The Setup and Terminology -- The Rapid Audit Steps -- Some Initial Sources of Data -- The Expert as the Instrument -- Supporting the Decision: Return on Controls -- Doing "Uncertainty Math" -- Visualizing Risk With a Loss Exceedance Curve -- Where to Go from Here -- Notes -- Chapter 4 The Single Most Important Measurement in Cybersecurity -- The Analysis Placebo: Why We Can't Trust Opinion Alone -- How You Have More Data than You Think -- When Algorithms Beat Experts -- Tools for Improving the Human Component -- Summary and Next Steps -- Notes -- Chapter 5 Risk Matrices, Lie Factors, Misconceptions, and Other Obstacles to Measuring Risk -- Scanning the Landscape: A Survey of Cybersecurity Professionals -- What Color Is Your Risk? The Ubiquitous-and Risky-Risk Matrix -- Exsupero Ursus and Other Fallacies -- Communication and Consensus Objections -- Conclusion -- Notes -- Part II Evolving the Model of Cybersecurity Risk -- Chapter 6 Decompose It: Unpacking the Details -- Decomposing the Simple One-for-One Substitution Model More Decomposition Guidelines: Clear, Observable, Useful -- A Hard Decomposition: Reputation Damage -- Conclusion -- Notes -- Chapter 7 Calibrated Estimates: How Much Do You Know Now? -- Introduction to Subjective Probability -- Calibration Exercise -- More Hints for Controlling Overconfidence -- Conceptual Obstacles to Calibration -- The Effects of Calibration -- Beyond Initial Calibration Training: More Methods for Improving Subjective Judgment -- Notes -- Answers to Trivia Questions for Calibration Exercise -- Chapter 8 Reducing Uncertainty with Bayesian Methods -- A Brief Introduction to Bayes and Probability Theory -- An Example from Little Data: Does Multifactor Authentication Work? -- Other Ways Bayes Applies -- Notes -- Chapter 9 Some Powerful Methods Based on Bayes -- Computing Frequencies with (Very) Few Data Points: The Beta Distribution -- Decomposing Probabilities with Many Conditions -- Reducing Uncertainty Further and When to Do It -- More Advanced Modeling Considerations -- Wrapping Up Bayes -- Notes -- Part III Cybersecurity Risk Management for the Enterprise -- Chapter 10 Toward Security Metrics Maturity -- Introduction: Operational Security Metrics Maturity Model -- Sparse Data Analytics -- Functional Security Metrics -- Functional Security Metrics Applied: BOOM! -- Wait-Time Baselines -- Security Data Marts -- Prescriptive Analytics -- Notes -- Chapter 11 How Well Are My Security Investments Working Together? -- Security Metrics with the Modern Data Stack -- Modeling for Security Business Intelligence -- Addressing BI Concerns -- Just the Facts: What Is Dimensional Modeling, and Why Do I Need It? -- Dimensional Modeling Use Case: Advanced Data Stealing Threats -- Modeling People Processes -- Conclusion -- Notes -- Chapter 12 A Call to Action: How to Roll Out Cybersecurity Risk Management -- Establishing the CSRM Strategic Charter Organizational Roles and Responsibilities for CSRM -- Getting Audit to Audit -- What the Cybersecurity Ecosystem Must Do to Support You -- Integrating CSRM with the Rest of the Enterprise -- Can We Avoid the Big One? -- Appendix A Selected Distributions -- Distribution Name: Triangular -- Distribution Name: Binary -- Distribution Name: Normal -- Distribution Name: Lognormal -- Distribution Name: Beta -- Distribution Name: Power Law -- Appendix B Guest Contributors -- Decision Analysis to Support Ransomware Cybersecurity Risk Management -- Bayesian Networks: One Solution for Specific Challenges in Building ML Systems in Cybersecurity -- The Flaw of Averages in Cyber Security -- Botnets -- Password Hacking -- How Catastrophe Modeling Can Be Applied to Cyber Risk -- Notes -- Index -- EULA. Quantitative Methode (DE-588)4232139-6 gnd Cyberspace (DE-588)4266146-8 gnd Risikomanagement (DE-588)4121590-4 gnd Sicherheit (DE-588)4054790-5 gnd |
| subject_GND | (DE-588)4232139-6 (DE-588)4266146-8 (DE-588)4121590-4 (DE-588)4054790-5 |
| title | How to measure anything in cybersecurity risk |
| title_auth | How to measure anything in cybersecurity risk |
| title_exact_search | How to measure anything in cybersecurity risk |
| title_full | How to measure anything in cybersecurity risk Douglas W. Hubbard, Richard Seiersen |
| title_fullStr | How to measure anything in cybersecurity risk Douglas W. Hubbard, Richard Seiersen |
| title_full_unstemmed | How to measure anything in cybersecurity risk Douglas W. Hubbard, Richard Seiersen |
| title_short | How to measure anything in cybersecurity risk |
| title_sort | how to measure anything in cybersecurity risk |
| topic | Quantitative Methode (DE-588)4232139-6 gnd Cyberspace (DE-588)4266146-8 gnd Risikomanagement (DE-588)4121590-4 gnd Sicherheit (DE-588)4054790-5 gnd |
| topic_facet | Quantitative Methode Cyberspace Risikomanagement Sicherheit |
| work_keys_str_mv | AT hubbarddouglasw howtomeasureanythingincybersecurityrisk AT seiersenrichard howtomeasureanythingincybersecurityrisk |