如何度量网络安全风险

Hacker News 上怎么说

• MattPalmer1086 · 2023 年

  ……“量化”技术是在将风险管理应用到威胁模型中。但业界管理风险的方式（把可能性和影响直接相乘）完全是不合逻辑的巫术玄学。去看看《网络安全风险量化分析》（How to Measure Anything in Cybersecurity Risk）[1]这本书吧，里面很好地解释了为什么这种做法行不通，并给出了更好的方法。长话短说就是：不行，安全领域目前大部分并没采用量化技术，但如果大家愿意的话，其实是完全可行的……

  …"quantitative" techniques is in applying risk management to threat models. But the way risk is managed in the industry (multiplying likelihood and impact) is completely incoherent and voodoo. See the book "How to Measure Anything in Cybersecurity Risk" [1] for a good explanation of why it doesn't work and better ways to do it. Which is a long way of saying, no, security doesn't use quantitative techniques mostly, but it would be possible if people…

• haskellandchill · 2024 年

  这真的不是无法量化的。我读了《网络安全风险量化分析》，简直大开眼界。通过建立风险和结果的对应表格，结合相关概率以及90%置信区间的金额损失影响，我们完全可以对各类技术债务进行量化。

  It’s really not unquantifiable. I read “How to Measure Anything in Cybersecurity Risk” and it was an eye opener. Using a table of risks and outcomes with associated probabilities and 90% confidence intervals of dollar impacts we can quantify categories of technical debt.

• rossjudson · 2026 年

  我推荐《网络安全风险量化分析》（How to Measure Anything in Cybersecurity Risk）。读起来非常有趣，讲的是如何给安全性赋予切实的价值。

  I recommend "How to measure anything in cybersecurity risk". Really interesting read about putting actual value on security.

• thinkmassive · 2022 年

  这让我想起了道格拉斯·哈伯德（Douglas Hubbard）写的《数据化决策》（How to Measure Anything）[1]。我读过《网络安全风险量化分析》，但核心概念其实都出自他的原著：- 任何测量都是一种近似 - 你可以通过从“下注”的角度思考来得出更准确的估值（或概率）。这本书并不是……

  It reminds me of "How to Measure Anything" by Douglas Hubbard [1] I read "How to Measure Anything in Cybersecurity Risk" but the relevant concepts are from his original book: - every measurement is an approximation - you can determine a more accurate valuation (or probability) by thinking in terms of bets The book isn't…

• haskellandchill · 2024 年

  那《数据化决策》里介绍的贝叶斯方法呢？它们已经被非常深入且有说服力地应用到了网络安全领域（见《网络安全风险量化分析》）。看起来围绕这套方法的咨询公司正在尝试把它推到产品管理领域（https://hubbardresearch.com/shop/measure-anything-project-ma...）。基本上……

  What about the Bayesian methods shown in "How to Measure Anything"? They have been applied to Cybersecurity ("How to Measure Anything in Cybersecurity Risk" in a very thorough and convincing manner. It looks like the business around it is trying to apply it to product management (https://hubbardresearch.com/shop/measure-anything-project-ma...). Basically…

正在加载完整评论……