Welcome to the talk page for How (not) to Measure Risk, a talk originally given at RSAC.
Haven’t you been told that you can measure anything? While some risk areas are measurable, the vast majority of the ones that security professionals encounter aren’t measurable, and trying to measure them might be a waste of your energy. Learn how to talk about risk, and when to use quantitative or qualitative measures, in service of your true goal: enabling your business to make wiser risk choices.
How to CISO relevant resources
- How to CISO Volume 2: Risk is the prose version of this talk.
- Why assessing third parties for security risk is still an unsolved problem is an oped related to this space.
Abstract
As a security practitioner, you’re often going to be asked to measure risk. This has a lot of different meanings, depending on who is speaking, so you’re going to have to listen carefully to the speaker to understand what they’re actually asking for. It’s possible that you’re being asked to provide a quantitative answer to the oft-asked (and very dangerously misleading) question, “Are we safe?” Or the question might be a variant of, “How do you know we’re prioritizing the right things? Which problems are the riskiest?” Or possibly you’re being asked for some measure of security efficacy – some KPIs to justify what you’re spending your resources on.
This talk covers three thematic sections. The first aims to provide some alternate vocabulary to more precisely communicate about risk. Practitioners don’t need to use this language, but this talk will aim to induce consistency, to avoid the miscommunication and vagueness around risk language. The second section covers various ways that organizations tend to measure and score risk. All of them have weaknesses, but some of them are very good at communicating specific forms of risk to specific stakeholders. This section will also cover and address those weaknesses, so you understand exactly how you might end up in trouble with certain risk measurement strategies. The third section will address the elephant in the room: understanding why we bother to measure risk at all, and exploring how to understand what you actually need to achieve your objective: wiser risk choices in your organization.