Ernie Hernandez
Excellent introduction to the area of risk assessment.
Concise and practical with excellent grounding in business process and strategy considerations.
Exactly what I was hoping for - specific ways to implement effective security controls and how to measure them.
Ties real world offensive techniques to how to defend them. Balance of practical examples and strategy.