FAIR Institute Blog

Jack Jones

Jack Jones

Recent Posts

There's More than One Bear...

[fa icon="calendar'] May 23, 2019 10:35:02 AM / by Jack Jones posted in Risk Management

[fa icon="comment"] 0 Comments

If you’ve been in the cybersecurity profession for any length of time, you’ll have heard (or said) the old chestnut about two hikers who run into a bear on the trail.  One hiker immediately takes off his hiking boots and puts on his running shoes. 

Read More [fa icon="long-arrow-right"]

Jack Jones: How Much Risk Does that Risk Represent?

[fa icon="calendar'] Feb 21, 2019 8:00:00 AM / by Jack Jones posted in FAIR, Risk Management

[fa icon="comment"] 2 Comments

Yesterday, while speaking to a university cybersecurity class, I was accused of being pedantic when I pointed out a problem with the phrase “The risk of that impact…”

Read More [fa icon="long-arrow-right"]

Security Exception vs. Risk Acceptance: What's the Difference?

[fa icon="calendar'] Feb 6, 2019 2:00:00 PM / by Jack Jones posted in FAIR, Risk Management

[fa icon="comment"] 5 Comments

FAIR model creator Jack Jones recently answered a FAIR Institute member's question about terminology that's one of those easily confused yet critical distinctions in cyber risk management: What's the difference between a security exception (or policy exception) and risk acceptance?

Read More [fa icon="long-arrow-right"]

A 'Kobayashi Maru' Exercise for ISO31000 Risk Analysis

[fa icon="calendar'] Nov 6, 2018 12:00:00 PM / by Jack Jones posted in FAIR

[fa icon="comment"] 0 Comments

Star Trek movie fans will likely recognize “Kobayashi Maru” as a reference to the training exercise used by Star Fleet to evaluate how cadets respond to a no-win scenario

Read More [fa icon="long-arrow-right"]

Clarifying "Upside" and "Positive" Risk

[fa icon="calendar'] Oct 30, 2018 9:00:00 AM / by Jack Jones

[fa icon="comment"] 0 Comments

You will hear some in the profession refer to “upside risk” and “downside risk”, or “positive risk” and “negative risk.”  This can be confusing for the vast majority of people who think of risk solely in terms of loss from adverse events

Read More [fa icon="long-arrow-right"]

Our Addiction to "Zero Cost" Risk Measurement

[fa icon="calendar'] Jun 20, 2018 9:00:00 AM / by Jack Jones posted in Risk Management

[fa icon="comment"] 0 Comments

One of the significant hurdles we have to overcome as a profession is our addiction to “zero cost” risk measurement.  Let me explain…

Read More [fa icon="long-arrow-right"]

A Question of CISO Focus: Technology or Business?

[fa icon="calendar'] May 7, 2018 1:08:14 PM / by Jack Jones posted in Risk Management

[fa icon="comment"] 0 Comments

A few days ago I had the privilege of providing the opening keynote address at an IANS event in Dallas.  If you’re not familiar with IANS (Institute for Applied Network Security), I encourage you to look into it as I believe it serves a very useful purpose and is working hard to be forward-looking.  Regardless, one of the questions that was discussed at this event was how much of a CISO’s focus should be on business versus technology. 

Read More [fa icon="long-arrow-right"]

Is Cyber Risk Measurement Just Guessing? Part 3 (of 3)

[fa icon="calendar'] Mar 8, 2018 9:02:00 AM / by Jack Jones posted in FAIR

[fa icon="comment"] 0 Comments

This last post in the series will focus on briefly summarizing and answering the thoughts/concerns posted by Martin Huddleston in his comments following Part 2.  I felt this follow-up post was warranted because some readers seemed to misinterpret Martin’s comments as an indictment

Read More [fa icon="long-arrow-right"]

Is Cyber Risk Measurement Just Guessing? -- Part 2

[fa icon="calendar'] Feb 6, 2018 2:17:28 PM / by Jack Jones posted in FAIR

[fa icon="comment"] 6 Comments

In the first post of this series, I focused on answering a commonly expressed concern about the reliability of cyber risk measurement. At the end of that post, I mentioned that some readers might draw a distinction between an example I gave and the real world of cyber risk measurement. 

Read More [fa icon="long-arrow-right"]

Ponemon Report on the True Cost of Compliance -- A Missed Opportunity

[fa icon="calendar'] Jan 3, 2018 9:00:00 AM / by Jack Jones posted in Risk Management, Jack Jones

[fa icon="comment"] 7 Comments

The Wall Street Journal recently referenced a research report published by Ponemon Institute entitled The True Cost of Compliance With Data Protection Regulations.  After reading the report I’ve come to the conclusion that although the research objective was admirable, it completely missed the target. 

Read More [fa icon="long-arrow-right"]
LEARN MORE

Subscribe to Email Updates

417NjDVYgtL._SX404_BO1204203200_.jpg
Learn How FAIR Can Help You
Make Better Business Decisions

Recent Posts