Robert Courtney
The IBM veteran behind the first quantitative risk analyses and a handful of laws that still hold.
Robert H. Courtney Jr. worked on data security at IBM through the 1960s and 70s and brought an economist's view to a field otherwise run on military classification levels. His method of weighing likelihood against cost – annualized loss expectancy – became the basis of FIPS 65, the US government's 1979 guideline on risk analysis.
He is best remembered for Courtney's laws: nothing useful can be said about the security of a mechanism except in the context of a specific application and environment; never spend more mitigating a risk than tolerating it will cost you; and there are no technical solutions to management problems, but there are management solutions to technical problems. He also argued early that errors and insiders do more damage than outside attackers – an observation the industry has rediscovered roughly every five years since.