The Risk Dr ®

  • Risk Work is Stressful

    My latest column was published today with the above title and I wanted to call out two things with this one. First, since risk drives the selection of priorities, it only follows that its stressful work. Decision making is mentally taxing, so the professionals whose job it is to facilitate that will shoulder that burden…

    ·

    ,

  • DeVry Charlotte 2014 Commencement Address

    On 27 June 2014, I delivered the Commencement Address to the graduating class at DeVry University Charlotte. I was honored to be asked by Dr. Regina Campbell. I didn’t post the address here previously, but I talk about risk so I thought it might be interesting to my followers here. Enjoy!   Thank you to Dr.…

    ·

  • Using Behavioral Interview Techniques to Assess Supplier Security Posture

    Organizations are increasingly furthering their goals through reliance on suppliers conducting critical work. In support of this, information security departments routinely conduct security assessments of those suppliers in order help minimize risk in their supply chains. These assessments usually consist of some combination of questionnaires, onsite observations, testing, and interviews. Unfortunately, such assessment routines tend…

    ·

  • Amish Approaches to Risk Management

    I’ve been watching Amish Mafia lately (a guilty pleasure). That got me to thinking about the role of shunning in good risk management (because this is how my mind works, apparently). We want our leadership to take good, appropriate levels of risk, which is a way of saying there are good behaviors to which we would like…

    ·

    , ,

  • The Definitive Guide to FAIR is now for sale everywhere!

    The wait is over! The definitive guide to using FAIR in your daily risk work is now for sale everywhere you care to buy books (which in today’s book business means Amazon, Google, etc.). It’s available in soft cover if you want a physical book and also on eBook. There are a few reviews out there…

    ·

  • Jack Jones Post on Justifying Security Spend

    Jack Jones wrote a blog  post for our publisher’s site about why its important to justify security spend, and how the industry is at a turning point about that.   Also,  another quick note: it seems that the book is available on Google  Play in eBook format (scanned pages; not reflow like you’d get on Kindle).  

    ·

    ,

  • Quick Book Update

    The book goes to the printers tomorrow…      

    ·

  • Book Preorder Available

    A quick update on the book: the publisher has made preorders available on their website. As the release comes closer, you will also be able to pick up a copy from your favorite retailer (Amazon, etc.)  

    ·

  • “Real Risk”

    I’ve noticed that the phrase “real risk” has been in use to mean a number of different things. I write about this in the July @ISACA column.  

    ·

  • Who Owns Loss Owns Risk

    My @ISACA column was published recently on risk ownership. Its a problem all risk professionals have to deal with at some point in their careers: when IT is expected to own what is ultimately business risk. I use absurdity to illustrate how absurd this is ;-) You can read the column here.

    ·

    ,