Rank by Loss, Not by Fright
Last timeSmall Steps That Add Up
A list of findings in no order is a list nobody acts on. Rank them by how much you would plausibly lose, with the two numbers written down so the order can be argued with.
Loss, not alarm
A findings list in no particular order has the same effect as no list. The
items get worked in the order they appear, or in the order somebody
remembers them, and the actual order is set by which ones sounded worst.
How alarming a finding sounds is a fact about its mechanism. Remote code
execution sounds dreadful. Unattributed read sounds like paperwork. But
the cost of an incident is a fact about the asset, and the mechanism tells
you nothing about the asset.
| how alarming it sounds, | plausible loss, 0 to 3 | rank by alarm | rank by loss | |
|---|---|---|---|---|
| code execution on the bu | 3 | 1 | 6 | 1 |
| any staff session reache | 1 | 3 | 1 | 5 |
| an outdated library with | 3 | 0 | 7 | 0 |
| no record of who read a | 0 | 3 | 3 | 4 |
| an open redirect on the | 2 | 1 | 5 | 2 |
| the export tool writes t | 1 | 3 | 2 | 6 |
| a slow endpoint that can | 2 | 2 | 4 | 3 |
The outdated library deserves its own sentence, because it is the finding
most likely to consume a week. It appears in a scan, it has a frightening
name, it has a published description with a severity attached, and the
severity was computed by somebody who has never seen your system. If the
component it sits in holds nothing and reaches nothing, the loss is zero
however the published figure reads.
The two numbers
Give every item two numbers. The first is the loss you would plausibly
take if it happened, in money where money makes sense and in a stated unit
of harm where it does not. The second is how often you would expect it in
a year.
The lesson stops here
4 more paragraphs to go
You have read the opening. The rest of the argument, the problems that check whether it landed, and the lines worth keeping at the end all come with a plan.
The first lesson of every course in the library reads the whole way through, free, so you can see exactly what the rest of them are.
See the planThe contentsThis is the reading half
Starting the course gives you your own copy of it. Every idea on every page has problems standing under it, marked with a reason rather than a tick, and any sentence you do not believe can be opened and argued with. None of that can happen on a page nobody owns.
The contents