We’re frequently asked what we’re reading and what we like in blog posts, so here are some interesting things that hit our RSS readers that you may have missed:
COBIT rivals ITIL from The IT Skeptic
“Everyone is tiptoeing around the fact that COBIT offers a significant competitive body of knowledge (BOK) to ITIL. Sure ITIL goes into more depth in places, but to say COBIT sits over the top is to grossly understate the overlap. COBIT extends a long way down into the “how” and it does it with an intellectual rigour that ITIL lacks.”
Interesting stuff that. A detailed mapping might help some folks. Either way, the good news for those keen on understanding risk management is that governance metrics, done right, allow us to understand a part of that “capability to manage risk” we’re always looking for. Assurance, verification and the acquisition and interpretation of knowledge is king. Speaking of which….
How To Tell When “Nothing Happens” by Pete Lindstrom
“…problem is that, it isn’t really true that “nothing happens” when you employ some specific security control to prevent an exploit. Not only that, but even when it is difficult to collect data on what didn’t happen, one can devise experiments to tell how frequently that nothing occurred.”
Good analysis is all about the uncertainty. Speaking of accounting for uncertainty…
Assets Good Until Reached For by Gunnar Peterson
“If you have a 100,000 dekstops or 100,000 servers it hard to manage. You will need to automate and to do that you need to abstract, but you should also realize that its a drawing on a whiteboard not reality. You need abstraction assurance.”
And there’s the trick. We might call “abstraction assurance” an analog to “confidence” or “uncertainty” in certain priors (metrics) or posteriors (calculated values based on those metrics). The stronger that abstraction assurance is, the less uncertainty we have in our knowledge and the better our ability to create wisdom from that knowledge (you know, make decisions).
Epstein, Snow and Flake: Three Views of Software Security by Adam Shostack
Adam’s focus is on software security, but the discussion here can be abstracted out into the broader realm of risk management quite nicely.
Two-thirds of firms hit by cybercrime from Security Focus
The US DoJ says that in 2005 (there’s some timely data) 2/3 of their surveyed firms detected at least one cybercrime. “Cybercrime” is “classified … into cyber attacks, cyber theft, and other incidents.” Pretty general. Also from the report: “Computer viruses made up more than half of all cyber attacks.”
(That sound you hear is me tapping my forehead lightly on large iron object)
Lessons Learned from “Personal” Risk Management By: Christopher Daugherty
“This process is what I call “personal risk management.” All of us have done it and will continue to do so. Why is it, then, many companies have ignored following similar principles with the on-going health of the business? This is a debate with many different answers so I ask you to select the best answer for your employer:
a) Have not ignored as this keeps me awake at night!
b) Please restate the problem, I cannot hear well with my head buried in the sand.
c) We passed our SOX audit so we checked this off the list!
d) We are informed of the challenge but we have a business to run and profits to make
e) Is this what internal audit and risk management has been telling us?”
