Skærp dine evner indenfor IT-risikostyring
Part Two: ‘We Should Never Have Said That’ and How to Avoid It Being Used Against You Before It’s Too Late
Earlier this year, the first part of this article was published. It’s a good place to start to learn why you want to understand your company’s attack surface. Websites and online databases tend to over-share – you should aim to limit this. But some...
Ask fewer and better questions – Right now!
In a previous article, When a robot gives better estimates than a human, Bo Thygesen from ACI describes how we use the LENS model to avoid human bias and have a “robot” estimate probability and loss for hundreds of systems better and faster than a human can do. How...
Webinar: An introduction to quantitative methods for cyber risk management
Almost daily, we hear about how cyber threats and IT risks increase globally across industries. Sadly, the methods and tools used for IT risk management today do not deliver the consistent decision support that organizations need. On March 23rd 2023, we conducted a...
ISO 27005 Is Wrong About Quantitative Risk
The International Standards Organization recently published an updated version of their guidance for information security risk management, but they have missed the mark entirely on quantitative methods. The ISO/IEC-27005 is one of the key standards published under the...
Identify your information assets in 5 steps
An important step in any IT risk management process is to clearly define the information assets in scope. But what is an information asset really? How can you best describe your important information assets? And why is it so important to spend time on establishing a...
NIS2 er vedtaget, hvad betyder det?
NIS2 trådte den 16. januar 2023 i kraft. NIS2 (Network and Information Systems Directive) er et EU-direktiv, der har til formål at øge IT-sikkerheden i EU. Dette skal herefter implementeres i de 27 landes love, hvor disse skal træde i kraft senest den 17. oktober...
Nu var det lige så hyggeligt
Verden er i forandring. De seneste år har mindet os om, at verden er farlig og foranderlig. Det er blevet den nye normal. Krig i Europa, klimakatastrofer, problemer med makroøkonomien og cyberangreb for blot at nævne nogle af de udfordringer, samfundet står over for....
The simplest risk metrics that we just can’t agree on
Inherent risk… residual risk… current risk? When your risk manager or regulatory affairs asks about your “inherent risk”, it highlights a fundamental flaw in qualitative risk assessments. Here’s why - and how to fix it. Although most of us engage in some form of risk...
Top 5 objections to using quantitative models within cyber risk management
Changing habits and mindsets take time and persistence. Especially within IT risk management. Again and again, we at ACI meet tonnes of objections to changing behaviour despite witnessing the benefits of moving from qualitative to quantitative. So, I felt...