讲这个最对口的书是 Freund 和 Jones 写的《Measuring and Managing Information Risk: A FAIR Approach》[0]。两本书都值得一读；Hubbard 对 FAIR 的影响显而易见而且很有益。FAIR 的优势在于它自带了一套相当完善的本体模型，用于……
The relevant book for this is Measuring and Managing Information Risk: A FAIR Approach by Freund and Jones[0]. Both books are worth reading; Hubbard's influence on FAIR is noticeable and positive. FAIR has the advantage that it comes with a fairly built-out ontology for…
我强烈推荐先读 ETS，再读《Measuring and managing information risk》，两本书都大篇幅讨论了这个。Magoo 也写了不少相关内容。我非常认同 ETS 中以支持业务使命为导向的视角，很多安全从业者都该学学这个。
I highly recommend reading ETS, then 'Measuring and managing information risk', both talk extensively about this. Magoo has written quite a bit as well. I really appreciate the mission support oriented perspective in ETS, something a lot of security practitioners could learn from.
……招聘和留住员工的成本。”如果我们真心希望 Google 做出改变，就应该想个办法，把道德上的愤怒转化为对引文中提到的某些利益的切实威胁。-- [0] -- 《Measuring and Managing Information Risk: A FAIR Approach》第 1 版，第 138 页。
…cost of acquiring and retaining employees." Iff we want Google to change, we should figure out a way to translate moral outrage into threatening some of the things mentioned in the quote. -- [0] -- Measuring and Managing Information Risk: A FAIR Approach 1st Edition, p. 138.
讲这个最对口的书是 Freund 和 Jones 写的《Measuring and Managing Information Risk: A FAIR Approach》[0]。两本书都值得一读；Hubbard 对 FAIR 的影响显而易见而且很有益。FAIR 的优势在于它自带了一套相当完善的本体模型，用于……
The relevant book for this is Measuring and Managing Information Risk: A FAIR Approach by Freund and Jones[0]. Both books are worth reading; Hubbard's influence on FAIR is noticeable and positive. FAIR has the advantage that it comes with a fairly built-out ontology for…
我强烈推荐先读 ETS，再读《Measuring and managing information risk》，两本书都大篇幅讨论了这个。Magoo 也写了不少相关内容。我非常认同 ETS 中以支持业务使命为导向的视角，很多安全从业者都该学学这个。
I highly recommend reading ETS, then 'Measuring and managing information risk', both talk extensively about this. Magoo has written quite a bit as well. I really appreciate the mission support oriented perspective in ETS, something a lot of security practitioners could learn from.
……招聘和留住员工的成本。”如果我们真心希望 Google 做出改变，就应该想个办法，把道德上的愤怒转化为对引文中提到的某些利益的切实威胁。-- [0] -- 《Measuring and Managing Information Risk: A FAIR Approach》第 1 版，第 138 页。
…cost of acquiring and retaining employees." Iff we want Google to change, we should figure out a way to translate moral outrage into threatening some of the things mentioned in the quote. -- [0] -- Measuring and Managing Information Risk: A FAIR Approach 1st Edition, p. 138.