Global Security, Privacy, & Risk Management

“Slicing the Pie”; Risk Management 101 February 11, 2012

This is a followup to “Risk 101: an Introduction to Risk” Security, and Risk are interesting topics that lend themselves to endless debate (and the occasional argument).  They are concepts that are bandied about quite frequently but, in my experience, are often not well understood by those using the terms.  I have been asked by clients to describe risk management and security in business terms.  At the risk of over simplifying the concepts, I will explain the concepts in this post.  Security can be described rather simply as the implementation of controls to counter address a vulnerability or address a threat.  Consider your house as an example.  If you install a lock on the front door, you are implementing a control (the lock) to address a vulnerability (an unlocked door) and a threat (that an unauthorized person will enter).

Risk can be described as the function of the likelihood of an event occurring and the impact should it occur.  Risk can be quantified using a simple formula (R=P% x I$) or expressed qualitatively.  In the scenario used above, there is a risk that your house will be burglarized.  Depending upon where you live, and other factors, the likelihood (expressed in terms of probability) will vary from unlikely to more likely to very likely.  The impact of the burglary will be determined by, among other things, the value of the assets that can be stolen.  So how does this relate to security?  The concepts are (or should be) inextricably entwined.

Controls should be implemented commensurate with the identified risk.

This is a very important concept.  Consider the following scenario.  If I were to offer you $1,000 to either 1) install a burglar alarm in your house or 2) install a fence to keep lions out of your yard, which option would you choose?  Likely most readers would respond with the statement; “it depends upon where I live”.  This demonstrates the example of security and risk management.  There are two risks we are considering in this scenario.  First, is the risk of burglary and second is the risk of lion attacks.  If you live in the Kenyan bush, you may be more concerned about Lions as the probability is likely higher of a lion entering the yard then of a burglar.  If you live in New York City you are likely more concerned about burglaries than lions as lions are not found in NYC (at least not legally).    The controls you are considering are either a lock (to address the issues described previously) or a fence to address the threat of a lion entering the yard.  Additionally, when we talk about ‘commensurate with the risk’ it means that the controls should be enough to address the risk but not too great.  You would not put a $1,000 alarm system on a $500 car.  It simply does not make sense and is an inefficient use of your limited resources.

With those topics covered very briefly, how do we discuss risk management from business terms?  Easy.  Consider that the risks to which you or your business are exposed are infinite.  You may not believe there is a risk of being hit by a meteorite but I can assure you that as infinitesimally small as the chance may be, there is a chance (probability) and the impact is likely not very good (injury or death).   If you question the example, read about the Sylacaugqa Meteorite here.

Now consider that the resources at your disposal (man hours, money, expertise, technology, information) is finite.  You may have a huge budget, and world class expertise but the fact remains that you have finite resources to address infinite risks.  The goal of risk management is to slice the pie of resources in a manner that allows you to address the greatest risks in the most efficient and effective manner possible.  There are four primary methods of risk mitigation; Avoidance, Reduction, Sharing, and Retention or Acceptance. Using the burglary example.

Avoidance– You can ensure you don’t own anything that could be stolen. Or you could live in an isolated area where nobody else lives.

Reduction– You can reduce the risk (by reducing probability or impact) by installing locks or using a safe to protect your assets.

Sharing– You can get insurance for your assets to reimburse you if they are stolen.

Acceptance– you can simply accept the fact that burglary is a possibility but one you are willing to accept if the likelihood is remote or you have no assets to steal.

The idea is to allocate the pieces of pie (which represents your finite resources) in a manner to address as much of the risk as possible.  It should be noted that there will always be residual risk and the possibility of Black Swan events.