How to Measure Anything in Cybersecurity Risk Quotes

“For all practical decision-making purposes, we need to treat measurement as observations that quantitatively reduce uncertainty.”
― Douglas W. Hubbard, How to Measure Anything in Cybersecurity Risk

“researchers have run experiments25 showing that experts can be trained to be better at estimating probabilities by applying a battery of estimation tests, giving the experts a lot of quick, repetitive, clear feedback along with training in techniques for improving subjective probabilities.”
― Douglas W. Hubbard, How to Measure Anything in Cybersecurity Risk

“A cybersecurity expert can become well versed in technical details such as conducting penetration tests, using encryption tools, setting up firewalls, and much more—and still be unable to realistically assess their own skills at forecasting future events.”
― Douglas W. Hubbard, How to Measure Anything in Cybersecurity Risk

“When we conduct a penetration test on a system, we are not changing the state of the application with this inspection; rather, we are changing our uncertainty about the state of the application.”
― Douglas W. Hubbard, How to Measure Anything in Cybersecurity Risk

“A nominal scale has no implied order or magnitude—like gender or location or whether a system has a given feature.”
― Douglas W. Hubbard, How to Measure Anything in Cybersecurity Risk

“Definition of Measurement Measurement: A quantitatively expressed reduction of uncertainty based on one or more observations.”
― Douglas W. Hubbard, How to Measure Anything in Cybersecurity Risk

“we need to treat measurement as observations that quantitatively reduce uncertainty.”
― Douglas W. Hubbard, How to Measure Anything in Cybersecurity Risk

“Concept of measurement. The definition of measurement itself is widely misunderstood. If one understands what “measurement” actually means, a lot more things become measurable. Object of measurement. The thing being measured is not well defined. Sloppy and ambiguous language gets in the way of measurement. Methods of measurement. Many procedures of empirical observation are not well known. If people were familiar with some of these basic methods, it would become apparent that many things thought to be immeasurable are not only measurable but may have already been measured.”
― Douglas W. Hubbard, How to Measure Anything in Cybersecurity Risk

“We need to lose less often in the fight against the bad guys. Or, at least, lose more gracefully and recover quickly.”
― Douglas W. Hubbard, How to Measure Anything in Cybersecurity Risk