I-4 2022 Talk: How do I get started? Easing your company into a quantitative cyber risk program

March 06, 2022 by Tony MartinVegue in Presentations

This is a companion post for my talk titled, “Baby Steps: Easing your company into a quantitative cyber risk program.” This blog post contains links and resources to many of the items and concepts mentioned in the talk.

Abstract:
Risk managers tasked with integrating quantitative methods into their risk programs - or even those just curious about it - may be wondering, Where do I start? Where do I get the mountain of data I need? What if my key stakeholders want to see risk communicated in colors?

Attendees will learn about common myths and misconceptions, learn how to get a program started, and receive tips on integrating analysis rigor into risk culture. When it comes to quant risk, ripping the Band-Aid off is a recipe for failure. Focusing on small wins in the beginning, building support from within, and a positive bedside manner is the key to long-term success.

SIRAcon 2021 Talk | Baby Steps: Easing your company into a quantitative cyber risk program

August 03, 2021 by Tony MartinVegue in Presentations

SIRAcon 2019: Incentivizing Better Risk Decisions: Lessons from Rogue Actuaries

November 16, 2019 by Tony MartinVegue in Presentations

What do Tom Jones’ chest hair, alien abductions, and Tylenol’s brand recognition have in common? An actuary – somewhere in the world – determined the probability and impact of a loss event and reduced enough uncertainty to issue an insurance policy. Yet, in the field of risk management, we hear that this is impossible: we can’t measure intangibles; we can’t determine the probability of an event that’s never happened, and oftentimes, measuring probability itself is not possible. The insurance industry shows us that this just isn’t true, and they have the money to prove it. Insurance is a thriving business with excellent margins, built on uncertainty reduction.

My SIRAcon 2019 Presentation Decks

May 02, 2019 by Tony MartinVegue in Presentations

Whew! Just wrapped up my two sessions at SIRAcon 2019. I’m posting my decks here and abstracts for attendees (or people that wish they attended) to reference. I realize that they may not make a ton of sense without the narration - I’m going to publish a videos and/or transcripts at a later date.

My first session was at the SIRAcon 2019 Pre-Conference Skills Workshop Day. I was joined by Lisa Young, Jay Jacobs, Richard Seiersen and David Severski to teach attendees modeling in R, the fundamentals of risk and pooling the opinions of experts. Here’s my session information:

CircleCityCon 5.0 | How to Lie with Statistics, Information Security Edition

June 02, 2018 by Tony MartinVegue in Presentations

Stiff statistics, prismatic pie charts, and questionable survey results drown the Information Security space in a sea of never-ending numbers that can be difficult to sift through. Have you ever finished reading a research institution’s annual security report and felt your Spidey sense begin to tingle with doubt or disbelief? What you are probably sensing is a manipulation of statistics, an age-old hoodwink that has been occurring as long as numbers have been used to convey information.

FAIR Institute | Crowdsourced Probability Estimates: A Field Guide

May 11, 2018 by Tony MartinVegue in Presentations

Probability estimates are the cornerstone of any good risk assessment in which data is sparse or expensive to come by, and are often thought of as one of the best ways to supplement existing information with subject matter expertise. Many risk analysts, however, can run into issues when trying to integrate the opinions of many subject matter experts into a risk management program. Some of these problems are: seemingly contradictory probability estimates, bias that can creep into results and the challenge of collecting and using large amounts of data.

RSA 2018 | Birds of a Feather: Quantitative Information Security Risk Management

April 19, 2018 by Tony MartinVegue in Presentations

Are you currently performing or interested in implementing quantitative risk management in your organization? This is your chance to meet other risk managers in the information security field, trade tips, methodologies and discuss advanced techniques. Attendance is strictly limited to allow for a small group experience.

RSA 2018 | Issues of Quantifying Risk around Identity and Access Management

April 18, 2018 by Tony MartinVegue in Presentations

Identity and access management (IAM) has been a longtime domain for information security. How much energy should we be investing in these programs? How much risk is there for managing identities? This session will feature top risk professionals to get their approaches and understanding of the issues involved.

Peerlyst Live | Becoming a security bookie: Improving your estimations with calibration

April 18, 2018 by Tony MartinVegue in Presentations

We make estimates every day in the field of information security. We regularly estimate the probability of a data breach, effectiveness of awareness training or projected staffing levels for the next 5 years.

Here’s the problem: humans are horrible at making estimates! All sorts of bias cloud our judgement, making it difficult to make good security decisions. Here’s the good news: it is possible to overcome some of these inherent biases with many of the same techniques that professional bookmakers use to set odds when placing and taking bets.

FAIR Institute Expert Panel

April 18, 2018 by Tony MartinVegue in Presentations

Expert Panel and Q&A on quantitative risk analysis with FAIR.

PRMIA 2018 Risk Management and Regulatory Compliance Round Table | Cybersecurity Aspects of Blockchain and Cryptocurrency

April 11, 2018 by Tony MartinVegue in Presentations

Many companies are considering blockchain technologies to make transactions faster, more secure and cost effective. If you are performing risk analysis on these emerging technologies, you ask be asking yourself: how do I even start to analyze risk when there are so many unknowns? A successful analysis requires a paradigm shift in thinking into two areas: casting aside the defense-in-depth metaphor to describe security controls; and, how we assess and analyze risk of new and emerging technologies that have a high degree of uncertainty.

SIRACon 2018 | Crowdsourced Probability Estimates: A Field Guide

February 07, 2018 by Tony MartinVegue in Presentations

NBTcon3 | Ransomware and Game Theory: To Pay, or Not To Pay?

December 22, 2016 by Tony MartinVegue in Presentations

What do the San Francisco Giants, Cryptolocker and nuclear war all have in common? They all involve conflicts in which incentives, payouts and winning strategies can be analyzed with game theory. Game theory is a branch of mathematics that models conflict and cooperation between parties and is used in many real-world decision making scenarios, inside and outside the Information Security field. Game theory is particularly useful in analyzing the extortionist / victim dynamic present in ransomware infection scenarios.

Measuring DDoS Risk with FAIR - FINAL.jpg

FAIR Institute, SF Bay Chapter Meeting: Cyber Attack Analysis with FAIR

November 21, 2016 by Tony MartinVegue in Presentations

FAIR Institute, SF Bay Chapter Meeting | San Jose, CA | November 16, 2016

FAIRcon | Measuring DDoS Risk Using FAIR

October 14, 2016 by Tony MartinVegue in Presentations

A step-by-step walkthrough of performing a quantitative risk assessment based on FAIR on DDoS attacks.

Security BSides, San Francisco | How to Lie with Statistics, Information Security Edition

April 20, 2015 by Tony MartinVegue in Presentations

Stiff statistics, prismatic pie charts, and stodgy survey results drown the Information Security space in a sea of never-ending numbers that can be difficult to sift through and find the relevant information contained within. Have you ever finished reading a vendor whitepaper or a research institution’s annual security report and felt your Spidey sense begin to tingle with doubt or disbelief? What you are probably sensing is a manipulation of statistics, an age-old hoodwink that has been occurring as long as numbers have been used to convey information.

U.S. Secret Service ECTF Winter Conference | Case Study: eGift Card Fraud

January 29, 2015 by Tony MartinVegue in Presentations

U.S. Secret Service Electronic Crimes Task Force Quarterly Meeting | San Francisco, CA | January 29, 2015

My speech at the ISACA San Francisco Fall Conference: How to Improve Your Risk Assessments with…

October 28, 2014 by Tony MartinVegue in Presentations

CISO’s and risk analysts alike often get caught up in checking boxes on a list of control objectives in order to satisfy compliance and regulatory requirements. However, companies that only view risk through a narrow, regulatory or compliance-focused lens have the potential to overlook a myriad of threats that could impact business continuity, customer privacy and security and financial solvency. The last several high-profile data breaches prove that compliance does not equal security.

ISACA Fall Conference | How to Improve Your Risk Assessments with Attacker-Centric Threat Modeling

October 15, 2014 by Tony MartinVegue in Presentations