リック・ハワード（Rick Howard）は、米国のサイバーセキュリティ専門家。米陸軍のコンピューター緊急対応チーム（CERT）の責任者を務め、民間ではパロアルトネットワークスやThe CyberWireの最高セキュリティ責任者（CSO）などを歴任した。米陸軍士官学校で工学を学び、米海軍大学院でコンピューター科学の修士号を取得。陸軍士官学校でコンピューター科学を教え、現在もカーネギーメロン大学のCISO向け幹部教育プログラムで講師を務めている。サイバーセキュリティ分野の重要書籍を選定・紹介する非営利団体Cybersecurity Canon Projectの共同創設者兼CEOであり、企業間の脅威情報共有を促すCyber Threat Allianceの設立にも参加した。サイバー対策の目的を、組織に重大な影響を及ぼす事象の発生確率を下げることと捉え、その目的から戦略と実務を組み立て直した『Cybersecurity First Principles: A Reboot of Strategy and Tactics』（未邦訳）を2023年に刊行。ゼロトラスト、攻撃の各段階での阻止、被害からの回復力、リスク予測、自動化を一つの枠組みにまとめている。軍と企業での運用経験をもとに、セキュリティへの投資や対策を、事業上の損失リスクをどれだけ減らせるかという観点から説明している。
Rick Howard is an American cybersecurity practitioner and executive whose career spans military network defense, corporate security, and professional education. He led the U.S. Army’s Computer Emergency Response Team and later served as Chief Security Officer at Palo Alto Networks and The CyberWire. His other leadership positions included CISO at TASC, General Manager of iDefense at VeriSign, and Global Security Operations Center Director at Counterpane. Howard earned an engineering degree from the U.S. Military Academy and a master’s degree in computer science from the Naval Postgraduate School. He taught computer science at West Point and teaches cybersecurity first principles in Carnegie Mellon University’s CISO Executive Program. He is the co-founder and CEO of the nonprofit Cybersecurity Canon Project, which selects and promotes significant cybersecurity books, and helped establish the Cyber Threat Alliance to support threat intelligence sharing among security companies. His examination of how security programs can be organized around reducing the probability of material harm to an organization, “Cybersecurity First Principles: A Reboot of Strategy and Tactics,” was published in 2023. The book connects zero trust, intrusion kill chain prevention, resilience, risk forecasting, and automation within a common strategic framework. Drawing on his experience in military and commercial environments, Howard explains how security leaders can assess technologies, operational practices, and investments according to their contribution to reducing business risk.
