A Look at How to Measure Anything in Cybersecurity Risk (Chapter 8)

by Phil Conrad

How to Measure Anything in Cybersecurity Risk, second edition
by Douglas W. Hubbard and Richard Seiersen

PART 2 - Evolving the Model of Cybersecurity Risk

Chapter 8 - Reducing Uncertainty with Bayesian Methods

This is probably the shortest chapter in the book so there's not a lot to cover in terms of a blog post.

The chapter starts off with a review of probability, which I found helpful since it's been several years since I learned this stuff. I recall a statistics course in college that I found particularly challenging. This review of probability leads to the Baye's rule and how one would write the probability equation. I was able to follow along pretty well and some stuff started coming back to me a little as well.

This is followed by the proof. Who remembers proofs? I think I remember them not being my favorite thing ever.

What I found most interesting in this chapter is the example they share. The example they pick is "Does Multifactor Authentication Work?" Beyond going through this problem they provide details to it on their website. At then end, given the scenario they are working with, they conclude there is a 93.66% probability that MFA works.

I'd like to see an example on the probability that I retained any statistics knowledge after twenty years! :)

That's all for this one. Thanks for tuning in.


Posted 2/26/24

Home