Ketil Stolen – författare

This book aims to help research practitioners in technology science avoid some of the most common pitfalls or at least make them easier to overcome. Many technology scientists put too little weight on how they conduct their work and should be able to become significantly better at what they do by being more aware of methodological issues. The book differs from other related works in two main respects: First, by focusing on creating, producing, or inventing new artifacts – in other words, technology science. Second, by describing a general approach to technology science linking together specialized research methods.

The book consists of 14 chapters. Following the first introductory chapter are two chapters providing the foundation for the rest of the book. These chapters clarify the meaning of key concepts and describe an overall process for technology science. The subsequent chapters 4–11 are about this process. Chapters 4, 5, and 6 concern problem analysis, research planning, and hypothesis formulation. The following five chapters then aim at evaluation. Chapter 7 introduces the concept of prediction, which plays a fundamental role in evaluating hypotheses. Chapters 8–10 address the evaluation of universal, existential, and statistical hypotheses. Chapter 11 concerns quality assurance and introduces the concepts of validity and reliability. Next, in chapters 12 and 13, we address publishing with an emphasis on the specifics of technology science. Eventually the last chapter, chapter 14, briefly introduces the philosophy of science.

The book systematically collects in the form of suggestions, recommendations, and guidelines the author’s 35-year experience as a researcher, author and reviewer in technology science. It is written for anyone working in technology science, from master’s students to researchers and supervisors.

This book provides a brief and general introduction to cybersecurity and cyber-risk assessment. Not limited to a specific approach or technique, its focus is highly pragmatic and is based on established international standards (including ISO 31000) as well as industrial best practices. It explains how cyber-risk assessment should be conducted, which techniques should be used when, what the typical challenges and problems are, and how they should be addressed.

The content is divided into three parts. First, part I provides a conceptual introduction to the topic of risk management in general and to cybersecurity and cyber-risk management in particular. Next, part II presents the main stages of cyber-risk assessment from context establishment to risk treatment and acceptance, each illustrated by a running example. Finally, part III details four important challenges and how to reasonably deal with them in practice: risk measurement, risk scales, uncertainty, and low-frequency risks with high consequence.

The target audience is mainly practitioners and students who are interested in the fundamentals and basic principles and techniques of security risk assessment, as well as lecturers seeking teaching material. The book provides an overview of the cyber-risk assessment process, the tasks involved, and how to complete them in practice.