Quantifying risk for decentralized offensive cyber operations
PhD thesis — Naval Postgraduate School, 2017. Full text: https://archive.org/details/quantifyingriskf1094554879
Arguments
Quantifying risk for decentralized offensive cyber operations
As authority for offensive cyber operations decentralizes, the binding constraint isn't tools but judgment — and this suggests a structured process can close the experience gap instead of leaving risk calls to heuristics and biases.
Organizations below the national level can't adequately assess the risks and consequences of offensive cyber operations because of inexperience — but a simulation framework that combines subject-matter expertise with explicit assessments of uncertainty lets inexperienced organizations assess cyber risk at a proficiency level equivalent to an experienced organization.
Why it matters
As authority for offensive cyber operations decentralizes, the binding constraint isn't tools but judgment — and this suggests a structured process can close the experience gap instead of leaving risk calls to heuristics and biases.
Use when: Inexperience is a process problem, not a talent problem — a framework that accounts for uncertainty can substitute for years of exposure.