I was very fortunate to have the opportunity to share my thoughts on KRIs last week on The FAIR Institute’s website. I used the metaphor of Sentinel Species (think canaries in coal mines) to serve as an indicator of risk, but not of risk itself. That important distinction is one that I strongly feel is a difference we aren’t making in our identification and use of KRIs.
You can read the full article here.
I wrote this latest bit for the @ISACA column after reading Richard Clarke’s book and trying to rationalize how it applies to cyber risk. It’s overly easy to predict failures and impending doom at a macro level, its much harder to do it at the micro level, which is infinitely more interesting and useful.
You can read more here
Bill Murphy‘s interview with me for his RedZone podcast was posted today. I had a great time talking with Bill about risk, FAIR, and forecasting. You can find the podcast here. It was a great discussion, and Bill was a very gracious host. His entire podcast series is worth subscribing to: he interviews some really interesting people who bring a diverse view to risk and security. I enjoyed listening to him interview my friend Jack Jones but I also enjoyed his recent discussions with Zach Schuler. Be sure to check them out.
The final post of the interview/blog series I did with the FAIR Institute was posted last night.
The folks over at the FAIR Institute were nice enough to interview me recently and turn it into a series of blog posts. Part 1 is up right now and sets the stage for how to assess quality in your Cyber Risk assessments.
Risk management is all about making forward-looking statements about things that may or may not come to pass. This is also known as forecasting. Read more about this in my latest @ISACA column.
I’m pleased to announce that I have been asked to present at the Cyber Risk North America conference on 15-16 March in NY. Its offered in conjunction with OpRisk North America where I presented last year.
I will be presenting on the theme of assessing quality using Risk Forecast Accuracy (a topic that was the subject of our article in the February ISSA Journal). Come for a great session on the practical approach of creating and measuring the accuracy of the rating tables for your organization. I’m scheduled to speak on the second day at the 11:40AM session.