Share <Embed>

List Price: $49.95

Save: $6.12 (12%)

+ $24.99 shipping

Arrives: Nov 4 - 20

Only 2 left in stock - order soon.
As an alternative, the Kindle eBook is available now and can be read on any device with the free Kindle app.

Secure transaction

Ships from	---SuperBookDeals
Sold by	---SuperBookDeals

Details

Ships from

---SuperBookDeals

Sold by

---SuperBookDeals

Deliver to Canada

Used: Good | Details

Sold by glenthebookseller

Deliver to Canada

Add to List

Added to

Unable to add item to List. Please try again.

Other Sellers on Amazon

Add to Cart

$51.68
+ $13.86 shipping

Sold by: Herb Tandree Philosophy Bks

Have one to sell?

Sell on Amazon

Flip to back Flip to front

Listen Playing... Paused You're listening to a sample of the Audible audio edition.
Learn more

See all 3 images

Follow the Authors

Jack Freund

Jack Jones

Measuring and Managing Information Risk: A FAIR Approach Paperback – September 5, 2014

by Jack Freund (Author), Jack Jones (Author)

94 ratings

See all formats and editions Hide other formats and editions

Price

New from

Used from

Kindle

"Please retry"

$47.74

—

Paperback

"Please retry"

$43.83

$40.05

Using the factor analysis of information risk (FAIR) methodology developed over ten years and adopted by corporations worldwide, Measuring and Managing Information Risk provides a proven and credible framework for understanding, measuring, and analyzing information risk of any size or complexity. Intended for organizations that need to either build a risk management program from the ground up or strengthen an existing one, this book provides a unique and fresh perspective on how to do a basic quantitative risk analysis. Covering such key areas as risk theory, risk calculation, scenario modeling, and communicating risk within the organization, Measuring and Managing Information Risk helps managers make better business decisions by understanding their organizational risk.

Customers who viewed this item also viewed

Page 1 of 1 Start overPage 1 of 1

This shopping feature will continue to load items when the Enter key is pressed. In order to navigate out of this carousel please use your heading shortcut key to navigate to the next or previous heading.

Douglas W. Hubbard

114

Hardcover
10 offers from $46.89
Evan Wheeler

41

Paperback
53 offers from $24.84
Douglas W. Hubbard

181

Hardcover
$33.71
Mark Talabis

27

Paperback
$34.96
Douglas W. Hubbard

21

Hardcover
$41.24
Adam Shostack

110

Paperback
$28.88
Only 1 left in stock - order soon.

Customers who bought this item also bought

Page 1 of 1 Start overPage 1 of 1

Douglas W. Hubbard

114

Hardcover
10 offers from $46.89
Evan Wheeler

41

Paperback
53 offers from $24.84
Douglas W. Hubbard

181

Hardcover
$33.71
Mark Talabis

27

Paperback
$34.96
Chris Sanders

18

Paperback
$39.72
Adam Shostack

110

Paperback
$28.88
Only 1 left in stock - order soon.

Special offers and product promotions

Amazon Business : For business-only pricing, quantity discounts and FREE Shipping. Register a free business account

Editorial Reviews

Review

"...informative and insightful―and surprisingly engaging. Using examples, anecdotes, and metaphors, the writers keep this educational work from becoming difficult... Professionals new to thorough information risk analysis or using more simplified approaches will find this book extremely useful." --Security Management

Review

A comprehensive resource that provides a much-needed, flexible methodology for measuring and managing information risk.

About the Author

Dr. Jack Freund is an expert in IT risk management specializing in analyzing and communicating complex IT risk scenarios in plain language to business executives. Jack has been conducting quantitative information risk modeling since 2007. He currently leads a team of risk analysts at TIAA-CREF. Jack has over 15 years in IT and technology consulting for organizations such as Nationwide Insurance, CVS/Caremark, Lucent Technologies, Sony Ericsson, AEP, Wendy’s International, and The State of Ohio.

He holds a BS in CIS, master's in telecommunication and project management, a PhD in information systems, and the CISSP, CISA, CISM, CRISC, CIPP, and PMP certifications. Jack is a visiting professor at DeVry University and a senior member of the ISSA, IEEE, and ACM. Jack chairs a CRISC subcommittee for ISACA and has participated as a member of the Open Group’s risk analyst certification committee. Jack’s writings have appeared in the ISSA Journal, Bell Labs Technical Journal, Columbus CEO magazine, and he currently writes a risk column for @ISACA. You can follow all Jack’s work and writings at riskdr.com.

Jack Jones, CISM, CISA, CRISC, CISSP, has been employed in technology for the past thirty years, and has specialized in information security and risk management for twenty-four years. During this time, he’s worked in the United States military, government intelligence, consulting, as well as the financial and insurance industries. Jack has over nine years of experience as a CISO with three different companies, with five of those years at a Fortune 100 financial services company. His work there was recognized in 2006 when he received the 2006 ISSA Excellence in the Field of Security Practices award at that year’s RSA conference.

In 2007, he was selected as a finalist for the Information Security Executive of the Year, Central United States, and in 2012 was honored with the CSO Compass award for leadership in risk management. He is also the author and creator of the Factor Analysis of Information Risk (FAIR) framework. Currently, Jack is co-founder and president of CXOWARE, Inc.

Item Weight : 1.85 pounds
Paperback : 408 pages
ISBN-10 : 0124202314
ISBN-13 : 978-0124202313
Product Dimensions : 7.5 x 0.93 x 9.25 inches
Publisher : Butterworth-Heinemann; 1st Edition (September 5, 2014)
Language: : English

Best Sellers Rank: #105,226 in Books (See Top 100 in Books)
- #78 in Information Management (Books)
- #285 in Computer Security & Encryption (Books)
- #1,645 in Leadership & Motivation

Customer Reviews:
94 ratings

Be the first video

Your name here

Customer reviews

5 star		73%
4 star		15%
3 star		7%
2 star		3%
1 star		3%

How are ratings calculated?

Top reviews from the United States

There was a problem filtering reviews right now. Please try again later.

Douglas W. Hubbard

Put this in your information security library

Reviewed in the United States on August 18, 2016

Verified Purchase

This is a great way for a information security professional to turn away from the "soft" methods of heat maps and ordinal scales. Information security needs real probabilistic methods to solve real risk assessment problems. Jack Jones and Jack Freund have found a great way to introduce these concepts by building a practical probabilistic method that cybersecurity experts can use - and already have used. I highly recommend it as required reading for information security professionals at all levels.

Douglas W. Hubbard
Co-author of How to Measure Anything in Cybersecurity Risk

15 people found this helpful

Helpful

Comment

G. McKee

You'll need the software

Reviewed in the United States on July 21, 2017

Verified Purchase

This is a really good treatment of information risk and will change the way you look at the topic. The problem is that there is little to no instruction on how to do the analysis calculations. You're left with the conclusion that you need to buy the special software in order to get the most from this book.

11 people found this helpful

Helpful

Comment

Steve Poppe

The CISO's Bible

Reviewed in the United States on April 21, 2015

Verified Purchase

In a world where seemingly everything is oversold, this is the rare exception that is undersold. The title succinctly states, without drama, the authors’ broad ambit. They over-deliver. The book is nothing less than a manifesto for quantitative management of information security risk.

Consider how radical it is to promise a truly quantitative approach to cyber risk management in a world dominated by numerous qualitative “frameworks,” red-yellow-green heat maps, thousand-item one-size-fits-all questionnaires, subjective and qualitative scales of likelihood and impact, and fake math like “red times green equals yellow”. And then consider how transformational it is to deliver on the promise.

Other reviewers have nicely discussed the book’s coverage of the FAIR taxonomy. Suffice it to say that MMIR is your best friend in understanding the Open Group FAIR standards. Freund and Jones bring a potentially dry subject alive with many “Talking About Risk” sidebars that tell of their experience with FAIR methods in practice. These war stories make the content accessible and relevant. I especially appreciate the authors’ informal style that is conversational without being verbose and humorous without being patronizing or cute. What the war stories leave out chapter 8 fills in with numerous example analyses. A worked example is better than a thousand war stories.

If giving a thorough rationale for and introduction to FAIR were all that MMIR did, it would be worth its weight in gold. But wait! There’s more!

It’s the “managing” part, chapters 11-14, that constitutes another breakthrough beyond FAIR. There Freund and Jones begin laying out (one senses it is a work in progress) a risk management ontology, built on the FAIR risk measurement ontology. In rethinking the classification of controls in the context of threat event frequency, vulnerability, and loss mitigation, they provide ways to assess and – yikes! – quantify the potential value of control improvements, in isolation or in combination. This gives the CISO the beginning of a way to manage the control environment, not just the threats.

But controls not consistently adhered to are both false comfort and all too common. Therefore F&J suggest that variance in the application of controls is perhaps the single most important set of infosec management metrics. As the old saw goes, if you cannot measure it you cannot manage it, and if you do not know how well your controls are operating on a continuing basis, then what confidence can you have in the millions of dollars invested in technology and staff?

Which brings us to metrics. It is perhaps not surprising that a methodology based on quantitative analysis lends itself to meaningful metrics. F&J offer many concrete suggestions far superior to the grab-bag of metrics found in vendor dashboards (measure what’s cheap and looks cool) and other books. These are real metrics that the CISO can use to … manage risk.

And managing risk is really why we do all this stuff. Making good decisions on both operational and strategic levels requires good data derived from reliable instruments and methods. It is in managing risk that MMIR is truly seminal and profound.

If they do another edition Freund and Jones should consider adding a subtitle, “The CISO’s Bible,” because CISOs will find themselves coming back to it time and again. Or maybe that is the next book.

8 people found this helpful

Helpful

Comment

Stefan Pettersson

A tremendous introduction to serious information security risk analysis

Reviewed in the United States on May 31, 2016

Verified Purchase

Measuring and Managing Information Risk: A FAIR approach is not like “traditional” information risk texts. Freund and Jones have taken the method far beyond what we are used to. They have the audacity to question the all too familiar “likelihood” and “impact scores” as well as their product, the “risk value” and its canvas, the "risk matrix".

The premier contribution they give is the amount of thought that went into their method and ridding it from illogical aspects. This has made the method somewhat contrived in my opinion but you can’t escape the fact that it fits together. Also, the authors put a big emphasis on using a careful and consistent terminology, something that is truly bothersome in information security risk today.

The FAIR method for analyzing risk does have rigor and may prove to give reliable results. Question is: will anyone but a select few bother to use it? Regardless, the book is a tremendous introduction to serious information security risk analysis, you will scoff at risk values and matrices after reading it.

2 people found this helpful

Helpful

Comment

Cubes58

Great prep for the cert

Reviewed in the United States on March 10, 2020

Verified Purchase

Excellent book. Clearly guides you through the FAIR methodology and it is a great preparation for the certification test. I took the training online and this book is a great guide to prep for the certification.

Helpful

Comment

Mark Gibson

Everything you need to know about quantitative cyber risk analysis to make the right investments to reduce loss exposrue

Reviewed in the United States on February 14, 2018

Verified Purchase

Think you need to learn more about quantitative risk analysis in cyber security, vs gut-feel decisions on where to spend precious dollars to improve security posture? This is the book and FAIR Institute is the place.

One person found this helpful

Helpful

Comment

Mom Dutcher

FAIR analysis

Reviewed in the United States on October 30, 2019

Verified Purchase

FAIR is a powerful way to analyze risk. I wish I’d read this years ago. I would have liked to have a bit more examples to compare to real life but it is a solid foundation to start to understand the FAIR process.

Helpful

Comment

OS68

or if you ever will end up using FAIR there is still good value to be attained

Reviewed in the United States on May 22, 2016

Verified Purchase

This is a valuable book on Risk Management. No matter if you believe or don't believe in quantitative risk management, or if you ever will end up using FAIR there is still good value to be attained. I didn't like the last 4 chapters. They felt like fillers.
I wish the authors would have made FAIR more accessible to outsiders by sharing Excel templates etc.

2 people found this helpful

Helpful

Comment

Top reviews from other countries

Gary

Hot and cold mix of useful tips and overuse of words requiring a dictionary to hand.

Reviewed in the United Kingdom on December 28, 2019

Verified Purchase

OK so I haven’t finished this book yet but am a good half way through. I can’t say so far that I have learnt a single way to change my approach, but I have picked up a number of good tips and different ways of thinking about risk. Perhaps that is the foundation I need though to change my approach? Or perhaps my current approach is satisfactory? Either way, I’ll take a view when I have finished it.

One thing I will say though about this book that I find annoying is the overuse of a small handful of words. Ontology for example is one, but there are a few others. It’s like the author had a quota to reach using each of these words so many times. Ontology is even used twice in the same short sentence in what I have read so far. It has reached the stage where it has become annoying and distracting as I sit here thinking surely a different word (obviously with the same meaning) could’ve been used in many places, and then find my mind drifting and realising I didn’t take in what I just read. The author is obviously smart so has no need in my opinion of using fancy words in such frequency when an everyday commonly spoken word will suffice.

I’ll try to update this review once I have finished the entire book, and providing I have not gone mad playing spot the ontology.

sec

Great content - But lack of explanation of resulting monte carlo figures reduces confidence.

Reviewed in the United Kingdom on September 7, 2019

Verified Purchase

The Factor analysis is of great value. However the LEAP from factor Min, Most Likely, Max to the output of Monte Carlo needs alot more Explanation. Simply stating a figure "looks about right" does not really help understanding as the figures from the App do not make sense in any literal/vertical way, requiring an understanding of formula and maths used in the App.
The content explain the factors for each sample scenario very well. Shame the APP / Magic derails confidence IMO.
I would stick to the Most Likely values and the let the client move the range to suit there internal needs.
The content will be very useful as a checklist when establishing Factors for likleihood and impact for scenarios

One person found this helpful

Winnow

Great way to break down InfoSec Risks into tangible impacts ...

Reviewed in the United Kingdom on April 17, 2018

Verified Purchase

Great way to break down InfoSec Risks into tangible impacts and provide credible articulations of risk. A much needed move away from pure prescriptive best practice controls (implicit risk management) to focused controls to assets that matter most. (Explicit risk management).

One person found this helpful

Shield Wall

An informative risk analysis model

Reviewed in the United Kingdom on April 25, 2020

Verified Purchase

If you are looking for a new way of efficiently articulating risk to your senior execs, I would highly recommend adding this to your reading list.

Freeda

Five Stars

Reviewed in the United Kingdom on August 22, 2017

Verified Purchase

Excellent, should be compulsory reading for all those charlatans claiming to do risk management. ;-)

One person found this helpful

See all reviews

Pages with related products. See and discover other items: data management, decision analysis, model making, health information management, process control