Security Risk Management Aide-Mémoire

by Julian Talbot

“All models are wrong. Some are useful.” - George Box The Security Risk Management Aide-Mémoire includes a range of models and tools to help security professionals to brief clients, conduct security risk assessments, facilitate workshops, draft reports, and more. Much of it is from the Security Risk Management Body of Knowledge with some new material reflecting updates such as Risk Management Standard. The book addresses all domains of security risk management but assumes you are already somewhat familiar with the contents and the specifics of your profession. The tools and models are complementary. Pick the ones that work best for you and ignore the rest or keep them in your back pocket for another day. You can download all the graphics and models for free from www.srmam.com

166 pages, Kindle Edition

Published October 30, 2019

Reviews

[Paul · Rating 5 out of 5]

Business security has always been a problem for businesses of any size. These days, it seems to be an even bigger problem. This book aims to help.

Security problems can come from any direction, whether it is from hackers, terrorism or an active shooter. They can also come at any time of the day or night. All companies, big and small, must have some sort of security plan in place and ready to activate at a moment's notice. For any company that does not have a plan in place, why not? "It will never happen to me," right?

Is your computer system as hacker-proof as possible? Do you need to beef up your physical security, perhaps with more, and better-trained, security guards? A tip has been received, stating that an "attack" is imminent. Is that tip reliable and credible? Is it designed to get you looking in one direction, while the actual attack is coming from a different direction? After the immediate security problem has been eliminated, evaluate your security plan. Did it work? Did it not work? Look at what needs to be changed for next time, for there will certainly be a next time.

This is a very specialized book, so it is not for the general reader. It assumes that the reader is familiar with the world of corporate security. There are many charts included, to make it easier to understand. For security professionals, this book is very much worth reading.

[Moataz · Rating 5 out of 5]

A recommended pragmatic material.

This book reflects the author’s long, diverse and pragmatic experience in the security risk assessment discipline. Th explicitly pronounced aim of the book of being a memory jogger has been sufficiently delivered. The books cover multiple aspects of security risks in a context that is addressed to those who have previous but not necessarily long experience in the domain. The content evolves from the first instance from general concepts passing by predominant methods to recommended best practice and lessons learned of lifelong experience. This material knowledge source devotes a great focus on risk assessment, treatments plan development, apart from the human factor reference in Part A & B. Also, the author presents very complicated concepts in a simple language.
Part A- Core Concepts: It addresses multiple dimensions, not only security risk-specific but also broader concepts that present value to other risk disciplines.
Part B- Methodology: This section touch base on the industry best practice and international standard without being dragged to the prolonged debates and dilemmas.
Part C- Additional tools It is a bonus to those heavily involved in the domain and seeking a memory refreshing tool or attempting new styles, and it is available in a relatively pocket-sized guide.
Part D- Models and frameworks: Gives an introductory to SRMBOK coupled with deep knowledge of ISO 31000.

[Don · Rating 5 out of 5]

There are few real ‘thought leaders’, ones who study, think, create and lead us to be challenged and to consider the way we see the world and our profession. One such leader is Julian Talbot. His latest book “Security Risk Management an Aide Memoire” does not provide new thought, what it does is summarises the known wisdom. The aide-memoire takes the basics of security risk management and presents them is simple, digestible packets. This can only be achieved by one who really understands the topic and its application. Each subject is addressed in a few pages, often in a single page, with the key elements clearly stated.
The aide-memoire is not a lesson in risk management, rather it is a summary of the key principles, concepts and practices. It is designed for those that already have an understanding of risk but need to refresh themselves, develop their understanding or explain to others the concepts and jargon which any discipline generates.
Even for the experienced practitioner there will be reminders of things forgotten and new ideas and approaches.
Laid out in a clear structure it is perfectly suited to its function of presenting the principles of identifying, assessing, treating and monitoring risks.
While incorporating security-specific concepts this aide-memoire will be of benefit to any risk manager. The art is keeping making the complex look simple and accessible; Julian Talbot has achieved this.
D. S. Williams CPP ASecM

[James Seaman · Rating 5 out of 5]

Often Cyber/InfoSec professionals dive straight into the application of security controls to shore up the defences of their organisation, ignoring the enigma that is Security Risk Management (SRM).

The Security Risk Management Aide Memoire helps to demystify SRM, to ensure that its importance is better understood and appreciated. The book is well laid out, with masses of useful references and information to assist Cyber/InfoSec professionals to gain an improved understanding of the frequently misunderstood subject.

The use of succinct diagrams, really assists the reader in understanding the various risk management models that are available to them in developing an effective protective security strategy - something thing that is extremely important for maintaining proactive and cost-effective defences.

[Scott Taylor · Rating 5 out of 5]

Security Risk Management is an incredibly broad field and with this book, the Author has been able to cover all the key elements in an efficient and easy to digest format whilst remarkably keeping it controlled in size. It has proven to be a very useful tool in the mentoring sessions i have been conducting and I would recommend it to any member of the security and risk industry as a solid pocket reference guide to keep handy.

[Mohamed Shahnawaz · Rating 5 out of 5]

SRMAM is useful, well-written and concise book on security risk management. It explains core concepts, methodology, models and frameworks well and would be a useful addition to the library of any security risk management practitioner. I would highly recommend this book.

[Pete · Rating 5 out of 5]

great summary of srmbok

This is a very useful summary of the SRMBOK. It works well as a cheat sheet of all the important concepts and definitions