Security Engineering – A Guide to Building Dependable Distributed Systems

I find this approach problematic in computer security systems because assigning a meaningful numerical risk turns out to be very, very difficult.

I'm often dealing with rare events that I'd prefer to happen 0 times. Very many of the kinds of failures I'm concerned about are black swans.

It's worse even than other kinds of engineering risk because the absolute risk of a specific attack changes as you add controls in other areas (weakest link effect).

Often the importance of certain things (say the value of certain ux security controls) depends on user behaviour, but usually the user research is lacking and too expensive to do (ie would cost more than the feature).

Vulnerability management is even worse! Any policy based on "risk scoring" (rather than evaluating specifics in context) ends up being basically scientism.

I find most numerical security exercises exasperating and what I've observed is that most people end up shuffling numbers until the scores that pop out match their intuition and judgement. I prefer not to even play that game if I can avoid it.

Perhaps I'm doing it all wrong.

I will say that in certain fields (fraud in particular) where you have enough data points to make meaningful decisions that numerical approaches do work really well.