Slashdot Mirror
Book Review: Measuring and Managing Information Risk: a FAIR Approach
benrothke writes It's hard to go a day without some sort of data about information security and risk. Research from firms like Gartner are accepted without question; even though they can get their results from untrusted and unvetted sources. The current panic around Ebola shows how people are ill-informed about risk. While stressing over Ebola, the media is oblivious to true public health threats like obesity, heart disease, drunk driving, diabetes, and the like. When it comes to information security, it's not that much better. With myriad statistics, surveys, data breach reports, and global analyses of the costs of data breaches, there is an overabundance of data, and an under abundance of meaningful data. In Measuring and Managing Information Risk: A FAIR Approach, authors Jack Freund and Jack Jones have written a magnificent book that will change the way (for the better) you think about and deal with IT risk. Keep reading for the rest of Ben's review.
Measuring and Managing Information Risk: A FAIR Approach
author
Jack Freund and Jack Jones
pages
408
publisher
Butterworth-Heinemann
rating
10/10
reviewer
Ben Rothke
ISBN
978-0124202313
summary
Superb overview to the powerful FAIR risk management methodology
The book details the factor analysis of information risk (FAIR) methodology, which is a proven and credible framework for understanding, measuring, and analyzing information risk of any size or complexity. An Open Group standard, FAIR is a methodology and a highly effective quantitative analysis tool.
The power of FAIR is immense: it enables the risk practitioner to make well-informed decisions based on meaningful measurements. While that seems obvious, in practicality, it is a challenging endeavor.
FAIR is invaluable in that it helps the risk professional understand the language that the corporate board and senior executives speak. Understanding that and communicating in their language can make it much easier for information security to be perceived as a valued asset, as opposed to using Chicken Little statistics.
FAIR takes the risk professional out of the realm of the dealing with risk via the checklist; which only serves to produce meaningless measurements, into the world of quantitative, defendable results.
For those that are looking for a tool to create pretty executive summary charts with lots of colors, FAIR will sorely disappoint them. For those that are looking for a method to understand how to calculate qualitative risk to support a formal enterprise risk management program, they won't find a better guide than this book.
The book is an incredibly good reference that will force you to look again at how you view risk management. Jones writes in the preface that the book is not about checklists and formulas, but about critical thinking. The authors note that information security and operational risk has operated for far too long as an art, with not enough science. This is the gap that FAIR attempts to fill.
The authors write that risk decision making quality boils down to the quality of information decision makers are operating from, and the decision makers themselves. The book does a remarkable job of showing how a person can become a much better decision maker.
A subtle but important point the book makes early on is that many risk professionals confuse risk possibilities with risk probabilities. The FAIR method forces you to focus on probabilities and not to obsess with Ebola like possibilities. Such a quantitative analysis approach is what makes FAIR so beneficial.
The book spends a few chapters on going through FAIR risk ontology and terminology. Inconsistent and poorly defined terminology is one of the most significant challenges the information security and operational risk profession faces. Having a consistent set of logical terms and definitions that make up the FAIR framework significantly improves the quality of risk relations communications within an organization.
The value of having a consistent set of logical terms and definitions is significant. For example, the book notes that many people use the term threat. In the context of risk analysis, it might not be a real threat if there is no resulting loss. In that case, it would be considered a vulnerability event.
The challenge of FAIR is acclimating to its dialect. But once done, it creates an extremely powerful methodology for risk communication and management. And therein lays its power. Setting up a common framework for risk management becomes and invaluable tool to present risk ideas. In addition, it makes the findings much more objective and defendable.
In chapter 5, the authors address the biggest objections to quantitative risk management that it can't be measured or is simply unknowable. They agree that risk can't be measured at the micro level, but it can be effectively measured to the degree to reduce management's uncertainly about risk. They also importantly note that risk is a forward-looking statement about what may or come to pass in the future. With that, perfect accuracy is impossible; but effective quantitative risk management is very possible.
The power of FAIR is that is helps add clarity to ambiguous risk situations by giving you the tools to add data points to a situation that is purported to be unknowable.
Chapter 8 is an extremely enlightening chapter in that it provides 11 risk analysis examples. The examples do a great job of reinforcing the key FAIR concepts and methods.
In chapter 10, the authors write that the hardest part of learning FAIR is having to overcome bad habits. For most people, FAIR represents a recalibration of your mental model about what risk is and how it works. The chapter deals with common mistakes and stumbling blocks when performing a FAIR analysis. The 5 high-level categories of mistakes the chapter notes are: checking results, scoping, data, variable confusion and vulnerability analysis.
FAIR is a powerful methodology that can revolutionize risk management. The challenge is that it takes a village to make such a change. Management may be reticent to invest in what is perceived as yet another risk management framework.
But once you start using the language of FAIR and validate your findings, astute management will likely catch on. Over time, FAIR can indeed be a risk management game changer.
The book is flawless in its execution and description of the subject. The only critique is that in that the author's should have been a bit more transparent in the text when (especially in chapter 8) mentioning the FAIR software, in that it is their firm that makes the software.
For those that are willing to put in the time to understanding FAIR, this book it will make their jobs much easier. It will help them earn the trust of senior management, and make them much better risk management professionals in the process.
Reviewed by Ben Rothke.
You can purchase Measuring and Managing Information Risk: A FAIR Approach from amazon.com. Slashdot welcomes readers' book reviews (sci-fi included) -- to see your own review here, read the book review guidelines, then visit the submission page. If you'd like to see what books we have available from our review library please let us know
The power of FAIR is immense: it enables the risk practitioner to make well-informed decisions based on meaningful measurements. While that seems obvious, in practicality, it is a challenging endeavor.
FAIR is invaluable in that it helps the risk professional understand the language that the corporate board and senior executives speak. Understanding that and communicating in their language can make it much easier for information security to be perceived as a valued asset, as opposed to using Chicken Little statistics.
FAIR takes the risk professional out of the realm of the dealing with risk via the checklist; which only serves to produce meaningless measurements, into the world of quantitative, defendable results.
For those that are looking for a tool to create pretty executive summary charts with lots of colors, FAIR will sorely disappoint them. For those that are looking for a method to understand how to calculate qualitative risk to support a formal enterprise risk management program, they won't find a better guide than this book.
The book is an incredibly good reference that will force you to look again at how you view risk management. Jones writes in the preface that the book is not about checklists and formulas, but about critical thinking. The authors note that information security and operational risk has operated for far too long as an art, with not enough science. This is the gap that FAIR attempts to fill.
The authors write that risk decision making quality boils down to the quality of information decision makers are operating from, and the decision makers themselves. The book does a remarkable job of showing how a person can become a much better decision maker.
A subtle but important point the book makes early on is that many risk professionals confuse risk possibilities with risk probabilities. The FAIR method forces you to focus on probabilities and not to obsess with Ebola like possibilities. Such a quantitative analysis approach is what makes FAIR so beneficial.
The book spends a few chapters on going through FAIR risk ontology and terminology. Inconsistent and poorly defined terminology is one of the most significant challenges the information security and operational risk profession faces. Having a consistent set of logical terms and definitions that make up the FAIR framework significantly improves the quality of risk relations communications within an organization.
The value of having a consistent set of logical terms and definitions is significant. For example, the book notes that many people use the term threat. In the context of risk analysis, it might not be a real threat if there is no resulting loss. In that case, it would be considered a vulnerability event.
The challenge of FAIR is acclimating to its dialect. But once done, it creates an extremely powerful methodology for risk communication and management. And therein lays its power. Setting up a common framework for risk management becomes and invaluable tool to present risk ideas. In addition, it makes the findings much more objective and defendable.
In chapter 5, the authors address the biggest objections to quantitative risk management that it can't be measured or is simply unknowable. They agree that risk can't be measured at the micro level, but it can be effectively measured to the degree to reduce management's uncertainly about risk. They also importantly note that risk is a forward-looking statement about what may or come to pass in the future. With that, perfect accuracy is impossible; but effective quantitative risk management is very possible.
The power of FAIR is that is helps add clarity to ambiguous risk situations by giving you the tools to add data points to a situation that is purported to be unknowable.
Chapter 8 is an extremely enlightening chapter in that it provides 11 risk analysis examples. The examples do a great job of reinforcing the key FAIR concepts and methods.
In chapter 10, the authors write that the hardest part of learning FAIR is having to overcome bad habits. For most people, FAIR represents a recalibration of your mental model about what risk is and how it works. The chapter deals with common mistakes and stumbling blocks when performing a FAIR analysis. The 5 high-level categories of mistakes the chapter notes are: checking results, scoping, data, variable confusion and vulnerability analysis.
FAIR is a powerful methodology that can revolutionize risk management. The challenge is that it takes a village to make such a change. Management may be reticent to invest in what is perceived as yet another risk management framework.
But once you start using the language of FAIR and validate your findings, astute management will likely catch on. Over time, FAIR can indeed be a risk management game changer.
The book is flawless in its execution and description of the subject. The only critique is that in that the author's should have been a bit more transparent in the text when (especially in chapter 8) mentioning the FAIR software, in that it is their firm that makes the software.
For those that are willing to put in the time to understanding FAIR, this book it will make their jobs much easier. It will help them earn the trust of senior management, and make them much better risk management professionals in the process.
Reviewed by Ben Rothke.
You can purchase Measuring and Managing Information Risk: A FAIR Approach from amazon.com. Slashdot welcomes readers' book reviews (sci-fi included) -- to see your own review here, read the book review guidelines, then visit the submission page. If you'd like to see what books we have available from our review library please let us know
The ISBN is wrong. It is 978-0124202313
To me risk assessment, even though I know it's important, will always be something MBAs force on developers because they are jealous of people who might actually have fun doing their job.
"The current panic around Ebola shows how people are ill-informed about risk. While stressing over Ebola, the media is oblivious to true public health threats like obesity, heart disease, drunk driving, diabetes, and the like."
Nonsense.
The media are focusing on Ebola because it is a relatively *unknown* risk for most, which makes it novel, which makes it news. They have extensively covered all of the other risks, and the public are generally well informed of the risks - or as informed as they are individually capable of being informed without one-on-one tutoring or coaching.
book reviews here? What was his name? Dent?
WHO estimates 20k will be infected with ebola and around 2/3 may die dues to it. Yet it is all over the news. meanwhile WHO states 1.5 million died from heart disease in 2012
makes you wonder who is trying to cover up what these days
And where is the MH370 plane?
KI
#include bier;
*7.4 million died of heart disease in 2012
#include bier;
Yeah, but heart disease kills you slowly and totally expectedly.
People aren't going to panic over legitimate pragmatic threats to their health they can(but won't) do something about.
Yeah well Heart Disease may kill more but its only because people eat so much damn food.
Hey joe wanna come to my house for the Super Bowl, we'll have 14 layer bean dip.We'll eat ourselves to death
Nahh I'm going to Ed's house, he is bleeding from his eyes because his team didn't make it to the big game, also he has ebola.
ebola is transmitted when you touch an infected person who is dying or died from it or get their bodily fluid in you. we know this now. what is so unexpected about that? even the people living in the affected areas are changing their behavior. 6k people a year die from texting while driving...its the media driving the ebola hysteria. enough already.
#include bier;
That is why their media is spreading these lies. They claim thousands have Ebola here when it has been proven that only a single person has it. The others were exposed as lies by McCain. He is a horrible person. He lies lies lies lies. That is what his kind does. They lie and kill children. That is why they reduced EBT so children will starve. The media is not covering this because they own every single paper in this shithole. Our country is dead. It died and now it is taking us down with it.
heart disease isn't contagious. Also if you take care of yourself (or if you're young) heart disease has little to no risk for you. Also heart disease doesn't make you bleed out from every orifice in your body. Also heart disease doesn't trash every organ in your body, just the heart. Need I go on?
er ya, mis-read your post. i think we are on the same page... carry on
#include bier;
I read the review, and appreciate it, but I'm still not entirely sure what FAIR is. It's a RISK management and communication technique, but I was hoping for a little more than that.....
"First they came for the slanderers and i said nothing."
Anyone can post book reviews. Read the book, write the review, it's great.
"First they came for the slanderers and i said nothing."
FAIR is invaluable in that it helps the risk professional understand the language that the corporate board and senior executives speak....For those that are looking for a tool to create pretty executive summary charts with lots of colors, FAIR will sorely disappoint them.
"First they came for the slanderers and i said nothing."
>> President Obola isnt done trying to be a maoist dictator,
Actually a Marxist dictatorbut u r rights on the other the other points.
not realty true. I once posted a 10 word book review for slashsdot and it was rejected. i don't have a lot to say.
Do you know chris roberts? He is the worst reviewer on amazonranked 25,000,00.
He is at http://www.amazon.com/gp/cdp/member-reviews/AH62BQTCMR3BR/ref=cm_pdp_rev_all?ie=UTF8&sort_by=MostRecentReview
i would like to see his reviews here.
Great point. Heart disease, diabetes, etc. are not "news". New risks are news by definition, and that's why they are covered in "the news".
If you want to read about diabetes, read "the olds" (AKA archives), not "the news". Thus, in the ebola case, "the news" are mostly doing their jobs. If you don't want to see "the news", but "the olds" instead, then don't fricken read/watch the news.
Maybe The Olds need catchier theme songs or voicings to make them more appealing. "Important things you already know about, but for...got [dramatic pause]. We'll help you remember this very important old information. The Olds![TM] Get it now, or, die of the known! The choice is yours and yours alone! [cue intense music]"
Table-ized A.I.
HRC = Her Royal ???
"While stressing over Ebola, the media is oblivious to true public health threats like obesity, heart disease, drunk driving, diabetes, and the like."
No, it's not. Actually, no matter how much the media repeat warnings about these issues, PEOPLE (a part of them) is oblivious to these public health issues. I dare you to watch CNN or read MSN, HuffPo or any news aggregator a day without something being said about at least one of these issues, mostly (in US) obesity. We even had a mayor on NYC that went into a series of highly controversial steps to prevent obesity (limiting size of sodas, really? Coach potatoes would buy 2 of them). it's just that some people doesn't pay attention because they don't want to change their lifestyle.
Ebola is something "new", so gets more flash from news outlets since people will cringe for, well, news. It's the way people work, unfortunately. In a BTVS season, the much bigger issues above would be the Big Bad. Ebola is just the monster of the week. Granted, it gets full attention now, but once current crisis is gone, I doubt you'll hear about it until another outbreak.
"Research from firms like Gartner are accepted without question; even though they can get their results from untrusted and unvetted sources."
"With myriad statistics, surveys, data breach reports, and global analyses of the costs of data breaches, there is an overabundance of data, and an under abundance of meaningful data."
Unchecked sources. Abundance of meaningless data. These are problems.
"The authors note that information security and operational risk has operated for far too long as an art, with not enough science. This is the gap that FAIR attempts to fill."
Yet, the book doesn’t seem to address those problems.
Waddy Wachtel was the dude.
But rather, a measure of its likelihood expressed with level of uncertainty. Other authors who have written about this subject urge us to be pedantic, while happily admitting that it is easier to say, "I am exposed to fraud risk", than "I am exposed to the risk of loss from fraud events". (http://www.soa.org/files/research/projects/research-new-approach.pdf)
It seems Freund and Jones get this right, yes. Good review.
Stop being an ass and pretending you don't know who she is. I know your kind hates women and wants to kill us, but pretending you don't know who the most powerful woman in the history of our country is, is just a lie. I KNOW YOU HATE US AND WANT US DEAD, BUT STOP BEING AN ASSHOLE. WE KNOW YOU DAMN WELL KNOW WHO BILL CLINTON IS. Why lie? Why does your kind constantly lie? Fuck you and your violence.