<story><title>Collection of awesome projects, blog posts, books, and talks on quantifying risk</title><url>https://github.com/veeral-patel/awesome-risk-quantification</url></story><parent_chain></parent_chain><comment><author>mathie25</author><text>Good ressources. I&amp;#x27;ve been following Ryan Mcgeehan for a few years, and he&amp;#x27;s really dedicated to the development of simple risk management techniques. Risk management can be really difficult to grasp.&lt;p&gt;Additional interesting ressources:
- Implementing Enterprise Risk Management by James Lam &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.amazon.ca&amp;#x2F;Implementing-Enterprise-Risk-Management-Applications&amp;#x2F;dp&amp;#x2F;0471745197&amp;#x2F;ref=sr_1_3?keywords=enterprise+risk+management&amp;amp;qid=1585660164&amp;amp;sr=8-3&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.amazon.ca&amp;#x2F;Implementing-Enterprise-Risk-Managemen...&lt;/a&gt;
- Protivi Guide to Enterprise Risk Management &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.protiviti.com&amp;#x2F;sites&amp;#x2F;default&amp;#x2F;files&amp;#x2F;protivitierm_faqguide.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.protiviti.com&amp;#x2F;sites&amp;#x2F;default&amp;#x2F;files&amp;#x2F;protivitierm_f...&lt;/a&gt;</text></comment>
<story><title>Collection of awesome projects, blog posts, books, and talks on quantifying risk</title><url>https://github.com/veeral-patel/awesome-risk-quantification</url></story><parent_chain></parent_chain><comment><author>rubidium</author><text>This is an interesting approach for information security. A lot better than doing nothing, but the blog post states Netflix has 2 full time engineers thinking just about risk.&lt;p&gt;But they’ve kinda just recreated a simplified traditional DFMEA... with some questionable choices on process and math.&lt;p&gt;Odd that they didn’t reference p&amp;#x2F;DFMEA or what failures they saw with that approach. Normally you’d model the risk of failure with a weibell curve. The Monte Carlo approach they use is ok but assumes all risks are equally weighted in time for a distribution. You then look at pre-mitigation and post mitigation risk to determine which actions to take.&lt;p&gt;That said, maybe they’ve never heard of the traditional dfmea process? Unlikely I would hope but possible.</text></comment>