-
-
-
BlogInfoSec.com Sponsors
-
-
BlogInfoSec.com Partners
-
Agile Security: Balancing Security with the Need for Agility written by Jeff Lowder
Jeff Lowder is an information security executive with a passion for continuous learning and innovation in information security risk management, with an exceptionally strong background in IT governance, inductive logic, and decision theory as it relates to risk analysis and risk management. He has over 12 years of management experience and 14 years of IT experience that span Internet security, strategic planning, incident response, compliance, information systems audit, business continuity planning, and project management.
His previous assignments include Director, Information Security at Disney Interactive Media Group, a branch of The Walt Disney Company; Sr. Security Architect / Manager, Network Security at NetZero; Director, Security and Privacy at Elemica; and Director, Network Security at the United States Air Force Academy, where he was named Information Protection Individual of the Year.
He has been published in multiple editions of the HANDBOOK OF INFORMATION SECURITY MANAGEMENT (ed. Harold F. Tipton and Mikki Krause, Auerbach Publications). He is a member of the ISSA and the Society for Risk Analysis. A graduate of Seattle Pacific University, with a B.S. degree in Computer Science, Lowder also is a Certified Information Systems Security Professional (CISSP) and has served on the boards of the Delaware Valley ISSA and the SANS Institute’s GSEC Certification Advisory Board.
Why the “Risk = Threat x Vulnerability x Impact” Formula is Mathematical Nonsense — Part 2
August 31, 2010 – 6:00 am
–
In my last post, I argued that security risk managers should stop using the “Risk = Threat x Vulnerability x Impact” formula (hereafter, the “R=TVC formula”), for two reasons. First, the variables “Threat” and “Vulnerability” are typically undefined;…
Why the “Risk = Threats x Vulnerabilities x Impact” Formula is Mathematical Nonsense
August 23, 2010 – 6:00 am
–
Every now and then I will find a security practitioner presenting the following formula when discussing information security risk analysis (ISRA).
Risks = Threats x Vulnerabilities x Impact
In some versions of this formula, the word “Consequence” is sometimes substituted for…
Decision Theory is the Foundation for Information Security Risk Management
August 18, 2010 – 6:00 am
–
Disclaimer: I originally wrote the following text as a post to a mailing list in 2005, but it still seems applicable today.
The more I read the writings of various information security professionals about information security risk analysis (ISRA), the more I’m struck by the following…
Reply to Jack Jones on the Meaning of “Risk”
July 29, 2010 – 6:00 am
–
In a recent post to his blog, Jack Jones asks, “What’s ‘a risk’ anyway?” This is a great question, especially since a lot of people working in information security seem to use the word in a variety of ways, ways that often violate common usage among risk…
The Difference between Quantitative and Qualitative Risk Analysis and Why It Matters (Part 3)
November 5, 2008 – 6:00 am
–
As we saw in part 2 of this series, some of the traditional arguments used for distinguishing between quantitative and qualitative risk analysis (RA) are based upon dubious assumptions. Many writers assume that “quantitative” equals objective and numerical, while…