The Cyber Risk Handbook: Creating and Measuring Effective Cybersecurity Capabilities (Wiley Finance)

Cyber Risk and cyber security are significant concerns for all organizations, and are now beyond the sole remit of IT. There are multiple resources about Cyber risk and security available, including some very good free ones that are published by the US government. Since this is a complex topic, imbued with some amount of fear-uncertainty-doubt, I prefer to rely on multiple sources of information. Seeing various viewpoints and approaches, even if I don't agree with them, helps to challenge and refine my thinking. This is where the Cyber Risk Handbook comes in.Each chapter of the Cyber Risk Handbook has been written by a different, authoritative person or group. The chapters are loosely held together wit the story of a fictional company and its CEO, who needs to update the board about cyber risk management. For me, using this story line was OK, it added some value and it's not intrusive. It is very clear that the chapters are written by different people, and at first it was a bit discordant. However, once I changed my perspective to first read each chapter as separate content, and then try to build a larger picture, it works much better.The explanations of various frameworks, processes, and techniques is very good, with copious and accurate footnotes and references. I frequently would break from the book to review the source data, which was very helpful and educational. My experience was that this is not a book to read in one sitting, but one that I read over time and delved more deeply into some areas. Now that I am familiar with the contents, and I've added a lot of bookmarks, this will make a good reference or refresher. Overall, I needed to invest a little time to get the best from the Cyber Risk Handbook, but once doing so, I found it worthwhile.

Don't let the derisive review by Mr. Arnold fool you. While he appears pretty adept at reviewing trousers and household products, he misses the point of this book entirely. It may be 300+ pages but in fact it does cover a lot of useful ground. Why? Because the stakeholders in cyber risk are in effect all functional leaders. Everyone has a stake in this exposure and an enterprise wide approach to dealing with it is overdue. After all, if CIOs and IT leaders knew how to prevent cyber attacks, they wouldn't be evolving with the speed and occurring with the frequency that they are, destroying increasing amounts of organizational value. There is no silver bullet, but there is a great need for an approach that emphasizes a more rapid and effective response with the latest tactics to a risk that seems to morph weekly. These realizations are the underpinning of Domenic's approach which draws in all functional leaders and highlights how and where they should play in this complex landscape. This then allows each stakeholder to focus on his/her role, to understand the role of others if desired and to leverage a maturity guided strategy that just might mitigate some of the magnitude of the impacts that result from cyber attacks. Congratulations to Domenic for recognizing the value of bringing this variety of expertise and opinion to the table and not try to be the single authority on a risk that has not single authority.

This book offers a cornucopia of strategies and practical measures that many organizations can implement to prevent, address, and mitigate cyber risks. That said, a significant missing element from this book for me as a practitioner in Enterprise Risk Management was an understanding of the nuances of public sector implementation challenges, namely collective bargaining environments and public procurement procedures. Many of these solutions simply were not applicable given the complexity of our environment, even if the aspiration or ideal is there. I think this book is better off in the hands of practitioners who are not constrained by the responsibilities of public serving agencies.

This is an excellent resource for cyber security professionals and those addressing cyber risk situations. This is not really for a casual reader as it addresses some pretty advanced topics. If you are a business that needs to set up cyber security safeguards, this will help you do that. It strikes a good balance between plain English writing, while still exposing the reader to the necessary jargon.

This is a thorough and up to date set of essays covering aspects of cyber risk and cyber risk management for non-specialists. While some essays are more clearly written than others, they communicate well.If you need a quick primer, or a set of actionable techniques to recommend, or to understand what your tech guys are recommending, this is a useful and comprehensive resource

Great handbook. It gives very nice entry introduction to the entire Cyber risk landscape and going in depth to how to implement, measure, etc. all of your defenses in the cyber age. Very good and thorough book. if you are an IT professional, you can't afford missing this book.

Fluff. High-level restatements of the obvious. A collection of vanity-essays. Of no value to the practitioner. Go to the NIST website and get all the guidance you'll ever need in this area for free - honed by NIST with taxpayer dollars over more than a decade, with serious usable approaches and none of the pablum that fills this "handbook." Example: makes the claim that there are no value-at-risk measures in the world re cybersecurity, which belies the fact that multiple products which estimate Value at Risk in multiple ways have been available for years. Not only is this book content free, but it's also obviously editor-free.