from Hacker News

Collection of awesome projects, blog posts, books, and talks on quantifying risk

by veeralpatel979 on 3/31/20, 6:46 AM with 12 comments

• by mathie25 on 3/31/20, 1:15 PM

  Good ressources. I've been following Ryan Mcgeehan for a few years, and he's really dedicated to the development of simple risk management techniques. Risk management can be really difficult to grasp.

  Additional interesting ressources: - Implementing Enterprise Risk Management by James Lam https://www.amazon.ca/Implementing-Enterprise-Risk-Managemen... - Protivi Guide to Enterprise Risk Management https://www.protiviti.com/sites/default/files/protivitierm_f...

• by rubidium on 3/31/20, 10:24 AM

  This is an interesting approach for information security. A lot better than doing nothing, but the blog post states Netflix has 2 full time engineers thinking just about risk.

  But they’ve kinda just recreated a simplified traditional DFMEA... with some questionable choices on process and math.

  Odd that they didn’t reference p/DFMEA or what failures they saw with that approach. Normally you’d model the risk of failure with a weibell curve. The Monte Carlo approach they use is ok but assumes all risks are equally weighted in time for a distribution. You then look at pre-mitigation and post mitigation risk to determine which actions to take.

  That said, maybe they’ve never heard of the traditional dfmea process? Unlikely I would hope but possible.

• by DyslexicAtheist on 3/31/20, 3:47 PM

  one of my favorite thinkers is Taleb: https://twitter.com/nntaleb

  Taleb books: https://www.amazon.com/Nassim-Nicholas-Taleb/e/B000APVZ7W

  also the USCSB youtube channel has post-mortems on industrial engineering accidents and disasters which I find really insightful https://www.youtube.com/channel/UCXIkr0SRTnZO4_QpZozvCCA

  any books / resources about a) complexity and b) D/FMEA!

  also avoid clueless academics and Steven Pinker or anyone invited to Davos/WEE like the plague!

• by bobm_kite9 on 3/31/20, 6:10 PM

  Can I mention Risk-First? All about applying risk to software development.

  https://riskfirst.org

• by kriro on 3/31/20, 2:59 PM

  """Risk quantification attempts to assign numeric values to risks, instead of qualitative labels such as "Critical" and "High"."""

  Nitpicky...but...

  Shouldn't risk always be quantified? I thought that's what sets it apart from uncertainty. Also I'd argue that "critical", "hight" etc. is also quantification (ordinal scale). I guess the argument is that it should be quantified on a nominal scale?

  That being said, love the list :)