Risk Is Not a Hammer, and Most Hazards Aren't Nails
summary
Claim: quantifying cyber risk usually fails to guide decisions because necessary iteration and causal links are missing. Evidence: a production auto run fix pushed by Windows Update where risk numbers mattered less than fear of breaking the update pipeline. Observations: over 200+ risk standards and the EU text uses "risk" 178 times without resolving debate. Proposals: treat techniques as measurable objects, measure precision without truth, and borrow evaluation methods from aviation and public health.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:56Risk in cybersecurity
- 3:20Threat modeling approach
- 6:55History of risk analysis
- 7:39Limits of risk quantification
- 10:09AutoRun case study
- 11:57Research beyond risk
- 12:18Risk literature gaps
- 13:25Uncertainty as a critical but overlooked factor
- 14:08Cyber adversary behavior
- 15:32Data gathering challenges
- 16:17Threat assessment precision
- 17:45Defender cost gap
- 18:52Alternative security frames
- 19:35Public health model
- 20:19Q&A
related talks
51mYou Can't Measure Risk
14mBathtubs, Snakes and WannaCry, Oh My! Risk in the Physical and Cyber World
36mNot Your Mama's Risk Assessment
41mExperiences in Risk Management
40mProtecting What Matters Most – Tools for Managing Risk
15mTelling Hard Truths to Impact Change in Cybersecurity
46mBusinesses Run On Risk And Debt: Why Communicating Security Risk Is Hard
26mThe Risky Business of Risk Illiteracy (Sean Juroviesky)