Lessons learned in risk measurement

This is a wide collection of observations and learnings applying risk measurement to cybersecurity.

I find that the strongest suggestion I can pull from my observations is that security engineers must be capable of structuring and organizing the risks they want to mitigate collaboratively with a large group. We did this with source code (CVS, SVN, Git, GitHub) and we probably need this attitude towards codification and collaboration on the subjective quantification of risk.

Most security organizations are swimming in data, and it is still a struggle to align the learnings from that data with the engineering objectives. Improving risk measurement is a big help with that, but equally important is to make sure that the mechanisms of your security function are aligned with the broader engineering team. If your planning cadence, delivery structures, and build processes are not aligned you are doomed before you start.