Tag: CRQ
-
Many organizations mistakenly believe they need extensive data and complex systems for Cyber Risk Quantification (CRQ). This article advocates for early adoption of quantitative risk measurement, starting small and evolving over time. By abandoning outdated qualitative ratings, organizations can access valuable insights, enhance decision-making, and achieve greater resilience in their risk programs from the outset.
-
I’m pleased to share my latest article in the ISACA Journal, titled “From Measurement to Management: Integrating Cyberrisk Quantification into Risk Governance.” In this piece, I explore how the newly updated NIST Cybersecurity Framework 2.0, with its focus on governance, is driving critical feedback loops between cyber operations and executive decision-making. In particular, I delve…
-
In this @ISACA newsletter column, I talk about some real-world perspectives I encountered where one organization was told they shouldn’t quantify cyber risk.
-
I wrote this piece as an analysis of what Marsh is experiencing in the marketplace. I wanted to have a cyber risk analyst’s take on the same data and to see where we could learn from their analysis and apply that in our practice. One edit, it looks like I made a typo. The line…
-
I had the pleasure of doing a live session on David Spark and Spark Media’s CISO Series with Nick Esponosa. Things got wacky but we also had a good time discussing with CRQ is and how it can help companies make better decisions. You can check out the highlights reel here and the full video…
-
A whitepaper I recently wrote for ISACA was published. You can access it here. In this paper I wanted to write about how cyber risk quantification worked broadly, not just in a FAIR context. I hope it gives you a good primer to this topic. I’m also doing an ISACA webinar with my good friend…
-
Here is a mega update on several items I’ve been working on lately. First, I did a podcast with ThreatConnect talking about CRQ. We did a bit of a retrospective on the FAIR book as well which was nice. Next is a piece I wrote for ISACA about how to not over-respond to current work…
-
Time for another roundup! Below are some works I’ve recently done on Apex Threat Agents, HITRUST, my time at the Gartner Summit, and some thoughts on Iranian attacks. How to Model Risk in an Apex Predator Cyber-World Enhancing HITRUST Risk Assessments with Cyber Risk Quantification (CRQ) Gartner 2019 Debate: Quantitative vs. Qualitative Cyber Risk Analysis…
The Risk Dr ® 