This book continues the work of the best-selling How to Measure Anything. Douglas Hubbard along with his co-author Richard Seiersen now exam the measurement of cybersecurity. There is a gold mine or quantitative learning, and unlearning, within a study of cybersecurity. This book will critique some of cybersecurity’s premier, seemingly quantitative, risk management approaches. It will be demonstrated that many of these “risk management” methods create more risk than they resolve. Questionable security risk management methods are duplicated across industries, embedded in products and largely accepted as gospel. The authors show some techniques that can be used to dramatically improve the norm. They will also show that some methods are beyond recovery and “worse than doing nothing”.
