Awesome Risk Quantification
Risk quantification attempts to assign numeric values to risks, instead of qualitative labels such as “Critical”
and “High”.
Doing this makes it easier to prioritize the different risks we need to mitigate. Also, “you can’t
improve what you can’t measure”!
This repository focuses primarily on cybersecurity related risks.
Open Source Projects
- Raven - a “flexible and multi-purpose uncertainty quantification, regression analysis, probabilistic risk assessment, data analysis and model optimization framework” from the Idaho National Laboratory
- riskquant - a library for computing risk, using different distributions, from Netflix
- evaluator - R package for quantitative risk assessment, based upon OpenFAIR
- collector - R package for “conducting quantitative risk assessment interviews”
Blog Posts and Papers
- 7 techniques for assessing frequency when quantifying cybersecurity risks - describes 7 techniques I either came up with, or found while researching risk quantification, for estimating the frequency of bad events
- Open-Sourcing riskquant, a library for quantifying risk - demonstrates how to use
their riskquant library
- 2018 in Review: How Our Bug Bounty Program Guided Prioritizing Work - discusses how HackerOne uses bug bounty related metrics, like time to resolution, to prioritize certain security initiatives
- Forecasting Risk inside an Organization - a post on how Atlassian attempts to forecast the chance of detecting red team operations, with the goal of improving detection over time.
- Simple Risk Measurement - in-depth guide covering scenarios, calibration, panels, Brier scores, Monte Carlo simulations, and a lot more. Check out his reading list as well.
- Ryan McGeehan’s blog - has 30+ posts on measuring risk and forecasting.
- Risk Management: Out with the Old, In with the New! - proposes we think of risks as parts of an interconnected system, not as isolated entities
- A New Approach for Managing Operational Risk - expounds on the approach in the article above, applying it to financial risk specifically
- Developing expert political judgment - describes a cognitive debiasing course sponsored by the intelligence community which increased Brier scores by 6 to 11%
- Ten commandments for superforecasters - lists ten practical tips for producing more accurate predictions
- Weather analysis and forecasting - a high-level overview of how meteorologists predict the weather
Books
Talks
- Quantifying Risk by Markus De Shon (2020) - walks through the process of measuring risk, from identifying threats and assets to guessing frequency and magnitude (in terms of money)
- Forecasting, Browsers, and “In The Wild” Exploitation by Ryan McGeehan (2019) - Ryan forecasts the probability of a Chrome zero day being exploited in the wild in a certain month
评论