FAIR standard creator Jack Jones spoke this week at the 2022 RSA Conference with the message that the future of risk measurement and management is (drum roll) artificial intelligence and automation. You might have heard the same in vendor booths on the show floor, but not like Jack told it: The industry won’t get there without a major shift left
Jack Jones Speaks at RSAC 2022 on AI, Automation, the Future of Risk Measurement and What It Will Take to Get There
[fa icon="calendar'] Jun 9, 2022 9:40:50 AM / by Jeff B. Copeland posted in Jack Jones, FAIR-CAM
Jack Jones: Automating Cyber Risk Quantification (Part 5 of 5)
[fa icon="calendar'] May 10, 2022 7:45:00 AM / by Jack Jones posted in Jack Jones, Jack Jones on Automating CRQ
In the previous post, I provided examples of some controls-related data that can’t be used to support automated cyber risk quantification (CRQ). But the news isn’t all bad. There are some data that can be used to support CRQ.
Jack Jones: Automating Cyber Risk Quantification (Part 4 of 5)
[fa icon="calendar'] May 3, 2022 1:50:19 PM / by Jack Jones posted in Jack Jones, Jack Jones on Automating CRQ
I covered a lot of ground in the previous posts, and rather than summarize them here I’ll assume you’ve read those posts already. So, let’s dive into the last analytic dimension…
Jack Jones: Automating Cyber Risk Quantification (Part 3 of 5)
[fa icon="calendar'] Apr 25, 2022 11:45:38 AM / by Jack Jones posted in Jack Jones, Jack Jones on Automating CRQ
In the previous two posts, I briefly discussed that:
- The CRQ market is rapidly growing, and there’s a strong desire to automate CRQ analysis...
Jack Jones: Automating Cyber Risk Quantification (Part 2 of 5)
[fa icon="calendar'] Apr 18, 2022 12:05:26 PM / by Jack Jones posted in Jack Jones, Jack Jones on Automating CRQ
In Part 1 of this series, I discussed that the market for cyber risk quantification (particularly automated CRQ) is growing rapidly, but that automation, done poorly, can to more harm than good. In this post, I’ll begin to discuss what it takes to automate CRQ responsibly.
Jack Jones: Automating Cyber Risk Quantification (Part 1 of 5)
[fa icon="calendar'] Apr 12, 2022 7:45:00 AM / by Jack Jones posted in Jack Jones, Jack Jones on Automating CRQ
Until recently, it’s mostly been organizations with visionary and early adopter tendencies who have embraced cyber risk quantification (CRQ). They understood the value and were willing to deal with the challenges.
How Cyber Risk Management Is Like Buying a Bike for Your Daughter – Understanding the FAIR Controls Analytics Model (FAIR-CAM)
[fa icon="calendar'] Jan 12, 2022 2:04:27 PM / by Jack Jones posted in Jack Jones, FAIR-CAM
In writing the FAIR-CAM™ white paper, I took a short detour from the complex landscape of cybersecurity to explain the new FAIR Controls Analytics Model™ with an analogy that almost anyone can relate to.
Jack Jones on Log4j: Take these Steps to Prepare for the Next Zero-Day Exploit
[fa icon="calendar'] Dec 22, 2021 8:40:24 AM / by Jack Jones posted in Jack Jones, Guides & Tips
The Apache Log4j security vulnerability uncovered recently is every cybersecurity defender’s nightmare - a zero-day exploited in a practically ubiquitous software library. Because zero-day exploits aren’t going away anytime soon, it’s important for organizations to increase their resilience to this type of change in the risk landscape.
Jack Jones: The Quality of Qualitative Risk Measurement (Continued)
[fa icon="calendar'] Nov 30, 2021 11:24:48 AM / by Jack Jones posted in Jack Jones, Jack Jones on Qualitative vs Quantitative
In my last blog post on qualitative risk measurement, I discussed three key aspects that often make the difference between good measurements and bad measurements — scope, model, and data. I also pointed out that these apply to both qualitative and quantitative risk measurement.
Jack Jones: The Quality of Qualitative Risk Measurements
[fa icon="calendar'] Nov 22, 2021 8:00:00 AM / by Jack Jones posted in Jack Jones, Jack Jones on Qualitative vs Quantitative
What makes for a high-quality qualitative risk measurement? The answer is simple. We just have to go back to the scope, model, and data elements