Internet Security and Programming

Andy Jaquith’s new excellent book, Security Metrics is a must-read for any anyone even slightly interested in getting more scientific about the Art of Security or perhaps even looking to rise up in unison against subjective, biased, sometimes excellent, oft-times not, auditors and other security reviewers that second guess everything you do. Your risk management decisions are always associated with the question “is it worth it?” and therefore must at least implicitly include a judgement call about value for every decision you make. So if your decision process includes “winging it” then you can pretend to ignore value and loss, but you really haven’t - you’ve just made it so personal and malleable as to create ambiguity everywhere and justify anyone’s position.

Read more…