Cyber Risk Cassandras

I wrote this latest bit for the @ISACA column after reading Richard Clarke’s book and trying to rationalize how it applies to cyber risk. It’s overly easy to predict failures and impending doom at a macro level, its much harder to do it at the micro level, which is infinitely more interesting and useful.

You can read more here

New Book: Fintech Growth and Deregulation

A new book I had the pleasure of editing, along with Diane Maurice and David Fairman, has been recently released. I received my copies today and I’m very happy with the results. This was an interesting project to work on and a problem space that is very modern and moving fast. I was very pleased with the authors I got to work with (Tony Martin-Vegue and Patrick McConnell). They did a great job covering their perspective of the topic (Quantification and Governance).

You can pick up a copy here.


Accepted at RSA – Quant Risk Implementation

I’m very pleased to announce that my proposal was accepted for this year’s RSA Conference! I’ll be giving an overview of the quantitative risk framework I’ve implemented at my firm, TIAA.

I’ll be speaking Wednesday morning (April 18th) in the Security Strategy Track as an Advanced Topic.

Here is the abstract:

This session will review the Cyber Risk Framework implemented by TIAA that scales from the granular level up to business-level aggregate risk reporting, avoiding some typical pitfalls by avoiding being too narrow or broad. Included in this session are discussions about policy, standards, configuration baselines, quantification, ORM/ERM risk reporting, and project lifecycle engagement. 

FAIR plays a big part in our framework, so you can be sure to have your questions answered about how to implement FAIR in your organization.

Lowest Common Risk Denominator

I tackle the notion of risk appetite in this month’s column using some metaphors with which you might be familiar. You don’t get to pick your auto insurance coverage by expressing the number of accidents you are willing to accept, yet that’s how a lot of organizations think about cyber risk. Fortunately, the cyber insurance industry is going to force us all into thinking about risk in dollars, the same as everyone else, because that is the lowest common risk denominator.

You can read more here.