Jim Seaman honed his skills and craft during a 22-year career in the Royal Air Force Police, with the final decade being employed on Counter Intelligence, Computer Security, Counter Terrorism and Risk Management duties. On completion of his 22-years of military service, he sought the new challenge of transferring his specialist skills and knowledge across to the corporate sector. In the decade since transitioning across to the corporate environment, he has fulfilled roles within Payment Card Industry Data Security Standard (PCI D)SS compliance, data protection, information security, industrial systems security and risk management. In the past few years, he has sought to further develop his knowledge and to rise to the challenge of authoring two books, one on the subject of PCI DSS (published May 2020) and the other on Protective Security (published Apr 2021).
Michael Gioia is an information security leader with over 18 years of experience delivering security solutions across several industries. He has served as an officer in the United States Air Force and worked in higher education, the Department of Defense, retail food services, and security consulting. He has performed most of his information security work within higher education, currently, as the Chief Information Security Officer (CISO) for Babson College and formerly as the Information Security Officer (ISO) at Eastern Illinois University, Rose-Hulman Institute of Technology, and Bentley University. He retains various professional certifications that include a Certified Information Security Manager (CISM) and Certified Data Privacy Solutions Engineer (CDPSE) from ISACA, Certified Information System Security Professional (CISSP) from ISC2, GIAC Security Leadership Certification (GSLC) from SANS, and Payment Card Industry Professional (PCIP) from the PCI Security Standards Council.
Jim Seaman honed his skills and craft during a 22-year career in the Royal Air Force Police, with the final decade being employed on Counter Intelligence, Computer Security, Counter Terrorism and Risk Management duties. On completion of his 22-years of military service, he sought the new challenge of transferring his specialist skills and knowledge across to the corporate sector. In the decade since transitioning across to the corporate environment, he has fulfilled roles within Payment Card Industry Data Security Standard (PCI D)SS compliance, data protection, information security, industrial systems security and risk management. In the past few years, he has sought to further develop his knowledge and to rise to the challenge of authoring two books, one on the subject of PCI DSS (published May 2020) and the other on Protective Security (published Apr 2021).
Michael Gioia is an information security leader with over 18 years of experience delivering security solutions across several industries. He has served as an officer in the United States Air Force and worked in higher education, the Department of Defense, retail food services, and security consulting. He has performed most of his information security work within higher education, currently, as the Chief Information Security Officer (CISO) for Babson College and formerly as the Information Security Officer (ISO) at Eastern Illinois University, Rose-Hulman Institute of Technology, and Bentley University. He retains various professional certifications that include a Certified Information Security Manager (CISM) and Certified Data Privacy Solutions Engineer (CDPSE) from ISACA, Certified Information System Security Professional (CISSP) from ISC2, GIAC Security Leadership Certification (GSLC) from SANS, and Payment Card Industry Professional (PCIP) from the PCI Security Standards Council.
The importance of businesses being Operationally Resilient is becoming increasingly more important and a driving force behind whether an organization can ensure that their valuable business operations can `Bounce Back´ from, or manage to evade, impactful occurrences is the Security Risk Management Capabilities.
In this book, we change the perspective on an organization´s operational resilience capabilities so that it changes from being a reactive (tick box) approach to being proactive. The perspectives of every chapter in this book are with a focus on risk profiles and how your business can reduce these profiles using effective mitigation measures.
The book is divided into two sections:
1. Security Risk Management.
All the components of Security Risk Management contribute to your organization´s Operational Resilience capabilities, to help reduce your risks.
Reduce the Probability/Likelihood.
2. Survive to Operate.
In the event that your SRM capabilities fail your organization, these are the components that are needed to allow you to quickly `Bounce Back´.
Reduce the Severity/Impact.
Rather than looking at this from an Operational Resilience compliance capabilities aspect, we have written these to be agnostic of any specific Operational Resilience Framework (e.g., CERT RMM, ISO 22316, SP 800-160 Vol. 2 Rev. 1, etc.), with the idea of looking at Operational Resilience through a Risk Management lens instead.
This book is not intended to replace these numerous Operational Resilience standards/frameworks but, rather, has been designed to complement them by getting you to appreciate their value in helping to identify and mitigate your Operational Resilience risks.
Unlike the Cyber Security or Information Security domains, Operational Resilience looks at the risks from a business-orientated view, so that anything that might disrupt your essential business operations are risk assessed and appropriate countermeasures identified and applied.
Consequently, this book is not limited to cyber-attacks or the loss of sensitive data but, instead, looks at things from a business holistic viewpoint.
|This book. 1. Provides innovative insights into more effective security risk management practices. Rather than being a reactive practice, this book will explain how security risk management can be implemented proactively for the improved benefits of the organization, ensuring proportionality, visibility and business-aligned risk decisions. 2. Describes the benefits of focusing security risk management ahead of security and compliance efforts. This book explains how effective security risk management can enhance an organization´s security and compliance obligations. 3. Applies lessons-learned from the authors´ experiences with security risk management. Real-life examples will demonstrate mistakes that are commonly made and provide insights into how these can be avoided, for the benefit of the organization. 4. Details how security risk management should be implemented and managed as a team effort. Providing insights into the value of delegated risk management, using a team approach. 5. Provides insights into the business value of effective security risk management and its importance in helping to reduce impactful events. Gain an understanding of how effective security risk management can be used to reduce the likelihood of an impactful event and to help you better prepare for such events, improving capabilities to survive to operate and reduce the potential impact on the organization.
The importance of businesses being `operationally resilient´ is becoming increasingly important, and a driving force behind whether an organization can ensure that its valuable business operations can `bounce back´ from or manage to evade impactful occurrences is its security risk management capabilities.
In this book, we change the perspective on an organization´s operational resilience capabilities so that it shifts from being a reactive (tick box) approach to being proactive. The perspectives of every chapter in this book focus on risk profiles and how your business can reduce these profiles using effective mitigation measures.
The book is divided into two sections:
1. Security Risk Management (SRM).
All the components of security risk management contribute to your organization´s operational resilience capabilities, to help reduce your risks.
- Reduce the probability/ likelihood.
2. Survive to Operate.
If your SRM capabilities fail your organization, these are the components that are needed to allow you to quickly `bounce back.´
- Reduce the severity/ impact.
Rather than looking at this from an operational resilience compliance capabilities aspect, we have written these to be agnostic of any specific operational resilience framework (e.g., CERT RMM, ISO 22316, SP 800- 160 Vol. 2 Rev. 1, etc.), with the idea of looking at operational resilience through a risk management lens instead.
This book is not intended to replace these numerous operational resilience standards/ frameworks but, rather, has been designed to complement them by getting you to appreciate their value in helping to identify and mitigate your operational resilience risks.
Unlike the cybersecurity or information security domains, operational resilience looks at risks from a business-oriented view, so that anything that might disrupt your essential business operations are risk-assessed and appropriate countermeasures identified and applied. Consequently, this book is not limited to cyberattacks or the loss of sensitive data but, instead, looks at things from a holistic business-based perspective.
Introduction.
Section One – Security Risk Management (SRM).
1. Finagling Your Business.
1.1 The Finagle Analogy. 1.2 Introduction. 1.3 The Importance of Effective Security Risk Management (SRM). 1.4 To Finagle, or not to Finagle, That Is the Question. 1.5 The Firefighting Paradox. 1.6 The Psychology of Finagling. Resource Investigator. 1.7 Effective Risk Communication. 1.8 When Security Risk Management Bites Back. 1.9 The Security Risk Management Enabler. 1.10 Decoding Security Risk Management
2. Business Impact Analysis.
2.1 A Vehicle Wheel and Tire/Tyre analogy. re2.2 Introduction to Business Impact Analysis/Assessment (BIA). 2.3 Understanding Recovery Point Objectives (RPO). 2.4 Understanding Recovery Time Objectives (RTO). 2.5 Identifying potential loss/impact. 2.6 Prioritizing business assets/processes/operations. 2.8 When BIA Bites Back. 2.8 Lessons Learned From Health & Safety (H&S). 2.8 Decoding Business Impact Analysis.
3. Asset Management.
3.1 The US Air Force Mission Statement Analogy. 3.2 Introduction. 3.3 What is an Asset?. 3.4 The Components of Effective Asset Management. 3.5 When Security Risk Management Bites Back. The Asset Management Enabler. Decoding Asset Management.
4. Risk-Based Vulnerability Management.
4.1 The First Aid analogy. 4.2 Introduction to Vulnerability Management. 4.3 What is vulnerability management?. 4.4 Difference between patch management and risk-based vulnerability management. 4.5 Applying project management techniques. 4.6 When Risk-Based Vulnerability Management Bites Back. 4.7 Decoding Risk-based Vulnerability Management.
5. Threat Management.
5.1 A Farming analogy. 5.2 Introduction to Threat Management. 5.3 Threat Modelling. 5.4 Attack Tree Threat Analysis. 5.5 Mitre Att&ck Threat Framework. 5.6 Mitre CAPEC. 5.7 Open-Source Intelligence (OSINT). 5.8 Internal Sources/Knowledge. 5.9 When Threat Management Bites Back. 5.10 Decoding Threat Management.
6. Risk Scenarios.
6.1 The `Big Bad Wolf´ analogy. 6.2 Introduction to Risk Scenarios. 6.3 The value of Risk Scenarios. 6.4 Prior Planning with Risk Scenarios. 6.5 Creating Risk Scenario Playbooks. 6.6 When Risk Scenarios Bite Back. 6.7 Decoding Risk Scenarios.
7. Quality Versus Quantity.
7.1. The Aging Brain Analogy. 7.2 Introduction to Risk Assessments. 7.3 Conducting Qualitative Risk Assessments. 7.4 Conducting Quantitative Risk Assessments. 7.5 Quality or Quantity? 7.6 Choosing Your Risk Assessment Types. 7.8 When Risk Assessments Bite Back. 7.9 Decoding Risk Assessments.
8. Developing a Risk Culture.
8.1 The British Military Deployments analogy. 8.2 An Introduction to Risk Culture. 8.3 Risk Culture versus `Security´ Culture. 8.4 Developing an effective Risk Culture. 8.5 Risk Culture Hierarchy. 8.6 When Developing a Risk Culture Bites Back. 8.7 Decoding Developing a Risk Culture.
9. Risk Enabling the Human Firewall.
9.1 Learning how to drive analogy. 9.2 An Introduction to Risk Enabling the Human Firewall. 9.3 Service Provider versus Service Enablement. 9.4 Achieving Risk-Based Service Enablement. 9.5 When a Lack of Risk Enabling the Human Firewall Bites Back. 9.6 Decoding Risk Enabling the Human Firewall
10. Risk-Based Security Operations.
10.1 The Human Security Operations Center – The Immune System. 10.2 An Introduction to Risk-Based Security Operations. 10.3 The Great Divide of Security. 10.4 Establishing a Risk-Based Security Operations Framework. 10.5 When Risk-Based Security Operations Bites Back. 10.6 Decoding Risk-Based Security Operations.
11. Creating Visibility & Insights Through Effective Security Risk Metrics.
11.1 A Vehicle Warning Lights analogy. 11.2 Introduction to Security Risk Metrics. 11.3 Creating Visibility & Showing a Return on Investments. 11.4 Converting Information into Actionable Intelligence. 11.5 Delivering the `Elevator (Lift) Pitch´. 11.6 When Security Risk Metrics Bites Back. 11.7 Decoding Security Risk Metrics.
Section Two – Survive to Operate.
12. Security Incident Management.
12.1 An Emergency & Military Services analogy. 12.2 Introduction to Security Incident Management. 12.3 What is a security incident?. 12.4 The Importance of an Effective Security Incident Management Practice. 12.5 It´s All In The Play. 12.6 When Incident Management Bites Back. 12.7 Decoding Incident Management.
13. Business Continuity Management.
13.1 Roadside assistance analogy. 13.2. Introduction to Business Continuity Management. 13.3 Understanding Business Continuity?. 13.4 Constructs of a BCP. 13.5 When Business Continuity Management Bites Back. 13.6 Decoding Business Continuity Management.
14. Disaster Recovery Management.
14.1 A Disaster Recovery analogy. 14.2 Introduction to Disaster Recovery. 14.3 Constructing Your DR Plan/Program. 14.4 Creating a Disaster Recovery Plan (DRP). 14.5 Validating the Effectiveness of Your DR Plan/Program. 14.6 When Disaster Recovery Bites Back. 14.6 Decoding Disaster Recovery (DR).
Section One: Security Risk Management Reducing the Likelihood/Probability, 1. Finagling Your Business, 2. Business Impact Analysis, 3. Asset Management, 4. Risk-Based Vulnerability Management, 5. Threat Management, 6. Risk Scenarios, 7. Quality Versus Quantity, 8. Developing a Risk Culture, 9. Risk-Enabling the Human Firewall, 10. Risk-Based Security Operations, 11. Creating Visibility and Insights Through Effective Security Risk Metrics, Section Two: Survive to Operate: Reducing the Impacts/Consequences, 12. Security Incident Management, 13. Business Continuity Management, 14. Disaster Recovery Management
For those seeking to mitigate risks that could harm their business, this guide is highly helpful in assisting them to do so.
Ben Rothke, CISSP, CISM, CISA
See the full review: https://www.asisonline.org/security-management-magazine/articles/2025/11/book-review-firefighting-paradox/
Inhaltsverzeichnis
Introduction.
Section One ¿ Security Risk Management (SRM).
1. Finagling Your Business.
1.1 The Finagle Analogy. 1.2 Introduction. 1.3 The Importance of Effective Security Risk Management (SRM). 1.4 To Finagle, or not to Finagle, That Is the Question. 1.5 The Firefighting Paradox. 1.6 The Psychology of Finagling. Resource Investigator. 1.7 Effective Risk Communication. 1.8 When Security Risk Management Bites Back. 1.9 The Security Risk Management Enabler. 1.10 Decoding Security Risk Management
2. Business Impact Analysis.
2.1 A Vehicle Wheel and Tire/Tyre analogy. re2.2 Introduction to Business Impact Analysis/Assessment (BIA). 2.3 Understanding Recovery Point Objectives (RPO). 2.4 Understanding Recovery Time Objectives (RTO). 2.5 Identifying potential loss/impact. 2.6 Prioritizing business assets/processes/operations. 2.8 When BIA Bites Back. 2.8 Lessons Learned From Health & Safety (H&S). 2.8 Decoding Business Impact Analysis.
3. Asset Management.
3.1 The US Air Force Mission Statement Analogy. 3.2 Introduction. 3.3 What is an Asset?. 3.4 The Components of Effective Asset Management. 3.5 When Security Risk Management Bites Back. The Asset Management Enabler. Decoding Asset Management.
4. Risk-Based Vulnerability Management.
4.1 The First Aid analogy. 4.2 Introduction to Vulnerability Management. 4.3 What is vulnerability management?. 4.4 Difference between patch management and risk-based vulnerability management. 4.5 Applying project management techniques. 4.6 When Risk-Based Vulnerability Management Bites Back. 4.7 Decoding Risk-based Vulnerability Management.
5. Threat Management.
5.1 A Farming analogy. 5.2 Introduction to Threat Management. 5.3 Threat Modelling. 5.4 Attack Tree Threat Analysis. 5.5 Mitre Att&ck Threat Framework. 5.6 Mitre CAPEC. 5.7 Open-Source Intelligence (OSINT). 5.8 Internal Sources/Knowledge. 5.9 When Threat Management Bites Back. 5.10 Decoding Threat Management.
6. Risk Scenarios.
6.1 The `Big Bad Wolf¿ analogy. 6.2 Introduction to Risk Scenarios. 6.3 The value of Risk Scenarios. 6.4 Prior Planning with Risk Scenarios. 6.5 Creating Risk Scenario Playbooks. 6.6 When Risk Scenarios Bite Back. 6.7 Decoding Risk Scenarios.
7. Quality Versus Quantity.
7.1. The Aging Brain Analogy. 7.2 Introduction to Risk Assessments. 7.3 Conducting Qualitative Risk Assessments. 7.4 Conducting Quantitative Risk Assessments. 7.5 Quality or Quantity? 7.6 Choosing Your Risk Assessment Types. 7.8 When Risk Assessments Bite Back. 7.9 Decoding Risk Assessments.
8. Developing a Risk Culture.
8.1 The British Military Deployments analogy. 8.2 An Introduction to Risk Culture. 8.3 Risk Culture versus `Security¿ Culture. 8.4 Developing an effective Risk Culture. 8.5 Risk Culture Hierarchy. 8.6 When Developing a Risk Culture Bites Back. 8.7 Decoding Developing a Risk Culture.
9. Risk Enabling the Human Firewall.
9.1 Learning how to drive analogy. 9.2 An Introduction to Risk Enabling the Human Firewall. 9.3 Service Provider versus Service Enablement. 9.4 Achieving Risk-Based Service Enablement. 9.5 When a Lack of Risk Enabling the Human Firewall Bites Back. 9.6 Decoding Risk Enabling the Human Firewall
10. Risk-Based Security Operations.
10.1 The Human Security Operations Center ¿ The Immune System. 10.2 An Introduction to Risk-Based Security Operations. 10.3 The Great Divide of Security. 10.4 Establishing a Risk-Based Security Operations Framework. 10.5 When Risk-Based Security Operations Bites Back. 10.6 Decoding Risk-Based Security Operations.
11. Creating Visibility & Insights Through Effective Security Risk Metrics.
11.1 A Vehicle Warning Lights analogy. 11.2 Introduction to Security Risk Metrics. 11.3 Creating Visibility & Showing a Return on Investments. 11.4 Converting Information into Actionable Intelligence. 11.5 Delivering the `Elevator (Lift) Pitch¿. 11.6 When Security Risk Metrics Bites Back. 11.7 Decoding Security Risk Metrics.
Section Two ¿ Survive to Operate.
12. Security Incident Management.
12.1 An Emergency & Military Services analogy. 12.2 Introduction to Security Incident Management. 12.3 What is a security incident?. 12.4 The Importance of an Effective Security Incident Management Practice. 12.5 It¿s All In The Play. 12.6 When Incident Management Bites Back. 12.7 Decoding Incident Management.
13. Business Continuity Management.
13.1 Roadside assistance analogy. 13.2. Introduction to Business Continuity Management. 13.3 Understanding Business Continuity?. 13.4 Constructs of a BCP. 13.5 When Business Continuity Management Bites Back. 13.6 Decoding Business Continuity Management.
14. Disaster Recovery Management.
14.1 A Disaster Recovery analogy. 14.2 Introduction to Disaster Recovery. 14.3 Constructing Your DR Plan/Program. 14.4 Creating a Disaster Recovery Plan (DRP). 14.5 Validating the Effectiveness of Your DR Plan/Program. 14.6 When Disaster Recovery Bites Back. 14.6 Decoding Disaster Recovery (DR).
