I meant to do this a while ago, but I wanted to mention that Alex Hutton has started blogging about Information Risk over at http://www.riskanalys.is/, “A place for Risk Geeks.”

They’ve chosen FAIR (Factored Analysis of Information Risk) as their preferred methodology for evaluating the world and have launched a new Risk Management consulting group, http://www.riskmanagementinsight.com, which utilizes and provides training on FAIR as well.

I also heppen to really like his latest conclusion:

“Hands-On Technical Skills” without “Soft Skills” is simply gathering information. The process to turn information into data, and data into decisions are “Soft Skills”. Hands-On Technical Skills are useless without “Soft Skills”. Likewise, Soft Skills are useless without good information gathering and processing. If Information Risk Management as a discipline is ever going to even approach the sophistication of a para-science and move towards the credibility of Economics or even Meteorology then we’ll need to be very good at both.

I always thought the flow was that data gets turned into information, which in turn gets turned into decisions, but either way, I still agree with his point. If you consider yourself a Risk Geek, then by all means stop by and wish Alex the best of luck in his new endeavor.

Thanks for the kind words.

Depends on your perspective/”state of nature” - most “metrics” collected with Richard’s “Hands-On Technical Skills” to this point are information to the people who collect them. However to the risk analyst it’s still just data, as it usually does not tell us all we need to know concerning threat capabilility or frequency, and rarely includes any “value” calculation.

But yeah, I should be much less “technically specific” in using my terms. Like I said, we’re risk geeks :)

My data analysis lifecycle runs roughly like:
You gather a Fact.
Get enough of them and you have data.
Get someone to interpret the data and you have information.
Get someone to do something as a result of that analysis and you have decisions.