Как оценить риски в кибербезопасности. Лучшие инструменты и практики - Ричард Сирсен

как было доказано, увеличивают вероятность ошибки. Учитывая важность оценки рисков кибербезопасности, следует продолжать искать пути совершенствования методов. Никогда не стоит забывать о скептицизме, вынуждающем нас задаваться вопросом: «Откуда я знаю, что это работает?»

Позже будет рассказано, как выйти за рамки существующих исследований и статистически грамотно отслеживать собственные данные, чтобы еще больше снизить неопределенность и иметь возможность постоянно совершенствовать методы оценки рисков. А в следующей главе мы продолжим анализ компонентов на основе существующих исследований, но сосредоточимся на методах, которые не приводят к улучшению результатов или даже ухудшают их. Это необходимо сделать, так как данные компоненты фактически являются частью наиболее широко используемых методов и стандартов в области кибербезопасности. Пришло время решить эти вопросы раз и навсегда, а также дать ответы на распространенные возражения против использования рекомендуемых нами методов количественной оценки.

Примечания

1. C. Tsai, J. Klayman, and R. Hastie, “Effects of Amount of Information on Judgment Accuracy and Confidence,” Organizational Behavior and Human Decision Processes 107, no. 2 (2008): 97–105.

2. Stuart Oskamp, “Overconfidence in Case-Study Judgments”, Journal of Consulting Psychology 29, no. 3 (1965): 261–265, doi:10.1037/h0022125. Reprinted in Judgment under Uncertainty: Heuristics and Biases, ed. Daniel Kahneman, Paul Slovic, and Amos Tversky (Cambridge, UK: Cambridge University Press, 1982).

3. P. Andreassen, “Judgmental Extrapolation and Market Overreaction: On the Use and Disuse of News,” Journal of Behavioral Decision Making 3, no. 3 (July – September 1990): 153–174.

4. C. Heath and R. Gonzalez, “Interaction with Others Increases Decision Confidence but Not Decision Quality: Evidence against Information Collection Views of Interactive Decision Making,” Organizational Behavior and Human Decision Processes 61, no. 3 (1995): 305–326.

5. D. A. Seaver, “Assessing Probability with Multiple Individuals: Group Interaction versus Mathematical Aggregation,” Report No. 78–73 (Los Angeles: Social Science Research Institute, University of Southern California, 1978).

6. S. Kassin and C. Fong, “I’m Innocent!: Effects of Training on Judgments of Truth and Deception in the Interrogation Room,” Law and Human Behavior 23 (1999): 499–516.

7. Paul E. Meehl, Clinical versus Statistical Prediction; A Theoretical Analysis and a Review of the Evidence (Minneapolis: University of Minnesota Press, 1954).

8. R. M. Dawes, D. Faust, and P. E. Meehl, “Clinical versus Actuarial Judgment,” Science (1989), doi:10.1126/science.2648573.

9. William M. Grove and Paul E. Meehl, “Comparative Efficiency of Informal (Subjective, Impressionistic) and Formal (Mechanical, Algorithmic) Prediction Procedures: The Clinical-Statistical Controversy,” Psychology, Public Policy, and Law 2 (1996): 293–323.

10. William M. Grove et al., “Clinical versus Mechanical Prediction: A Meta-Analysis,” Psychological Assessment 12, no. 1 (2000): 19–30.

11. Paul Meehl, “Causes and Effects of My Disturbing Little Book,” Journal of Personality Assessment 50 (1986): 370–375.

12. William Bailey et al., “Taking Calculated Risks,” Oilfield Review 12, no. 3 (Autumn 2000): 20–35.

13. G. S. Simpson et al., “The Application of Probabilistic and Qualitative Methods to Asset Management Decision Making,” presented at SPE Asia Pacific Conference on Integrated Modeling for Asset Management, April, 25–26, 2000, Yokohama, Japan.

14. C. W. Freaner et al., “An Assessment of the Inherent Optimism in Early Conceptual Designs and Its Effect on Cost and Schedule Growth.” Paper presented at the Space Systems Cost Analysis Group/Cost Analysis and Forecasting/ European Aerospace Cost Engineering Working Group 2008 Joint International Conference, European Space Research and Technology Centre, Noordwijk, The Netherlands, May 15–16, 2008, European Space Agency, Paris, France.

15. Philip E. Tetlock, Expert Political Judgment: How Good Is It? How Can We Know? (Princeton, NJ: Princeton University Press, 2005; Kindle edition, location 869).

16. Robyn Dawes, House of Cards: Psychology and Psychotherapy Built on Myth (New York: Simon & Schuster, 1996).

17. Amos Tversky and Daniel Kahneman, “Belief in the Law of Small Numbers,” Psychological Bulletin 76, no. 2 (1971): 105–110.

18. Daniel Kahneman and Amos Tversky, “Subjective Probability: A Judgment of Representativeness,” Cognitive Psychology 3 (1972): 430–454.

19. William M. Grove and Paul E. Meehl, “Comparative Efficiency of Informal (Subjective, Impressionistic) and Formal (Mechanical, Algorithmic) Prediction Procedures: The Clinical – Statistical Controversy,” Psychology, Public Policy, and Law 2 (1996), 293–323; #167.

20. Herren DeWispelare and Clemen Bonano, “Background Report on the Use and Elicitation of Expert Judgement”, prepared for Center for Nuclear Waste Regulatory Analyses under Contract NRC-02-93-005, September 1994.

21. I. Ben-David, J. R. Graham, and C. R. Harvey, Managerial Miscalibration (No. w16215) (Washington, DC: National Bureau of Economic Research, 2010).

22. D. Kahneman and A. Tversky, “Subjective Probability: A Judgment of Representativeness,” Cognitive Psychology 4 (1972): 430–454; D. Kahneman and A. Tversky, “On the Psychology of Prediction,” Psychological Review 80 (1973): 237–251.

23. Sarah Lichtenstein, Baruch Fischhoff, and Lawrence D. Phillips, “Calibration of Probabilities: The State of the Art to 1980,” in Judgement under Uncertainty: Heuristics and Biases, ed. Daniel Kahneman, Paul Slovic, and Amos Tversky (Cambridge, UK: Cambridge University Press, 1982).

24. L. Goldberg, “Simple Models or Simple Processes?: Some Research on Clinical Judgments,” American Psychologist 23, no. 7 (July 1968).

25. Paul J. Hoffman, Paul Slovic, and Leonard G. Rorer, “An Analysis-of-Variance Model for the Assessment of Configural Cue Utilization in Clinical Judgment,” Psychological Bulletin 69, no. 5 (1968): 338.

26. Amos Tversky and Daniel Kahneman, “Judgment under Uncertainty: Heuristics and Biases,” Science 185, no. 4157 (1974): 1124–1131.

27. D. Ariely et al., “Coherent Arbitrariness: Stable Demand Curves without Stable Preferences,” The Quarterly Journal of Economics 118, no. 1 (2003): 73–106.

28. R. Clemen and R. Winkler, “Combining Probability Distributions from Experts in Risk Analysis,” Risk Analysis 19 (1999): 187–203.

29. Шуровьески Д. Мудрость толпы / Пер. В. Логвинова. – М.: МИФ, 2013. – 410 с.

30. Donald