3 ms·

So you'd give this 1 on a scale from 1 to 3? Presumably 3 being the most serious. That doesn't make any sense. If this bug is present, this is instant total co

So you'd give this 1 on a scale from 1 to 3? Presumably 3 being the most serious. That doesn't make any sense. If this bug is present, this is instant total control of a PC. That's as bad as it gets.

stordoff 9y ago
Unless OP edited his post, he appears to be scoring it 100 (i.e. it's off the scale).
- vardump 9y ago
  I misread grandparent post. The scale is 1-3 x 1-3, in other words, from 1 to 9. 0.01 * 100 is 1.
  - gerdesj 9y ago
    I was being silly and making quite a few assumptions about readers - which is also daft. This is a really awful snag but it has all ready been patched if you apply them.
  - stordoff 9y ago
    Ah, I see. I was reading it as two axes, not a product.
    - gerdesj 9y ago
      Yes a product although the term "two axes" works as well. It's a pretty common way of quantifying "risk" into something that you can tabulate and form a todo list. You list your risks and give each one a score from 0-9 that is made up of "chance of happening" x "business impact or importance or whatever". You could score either as zero as well which will obviously cause the total score to be zero. I'll be changing our Risk Reg soon to become a Risks and Opportunities Register after a discussion in our last ISO 9001 audit. Not sure how the scoring scheme will work for that yet. This may look like a bit of a silly pseudo formal exercise but it really does help with decision making. There's nothing wrong with bending the scores either, if you are open about it. It is simply a way of prioritising a list of things to do in the end. I have to be a PHB sometimes as well as a sysadmin 8)
gerdesj 9y ago
Sorry, I was being silly. Our RR (is not unusual) in having a scoring system. We normally score from 0-9. There are two parts: "How likely is this thing going to happen" and "what will it do". Both parts are given a score of 1-3 and then the scores are multiplied together to get the Risk score (we use slightly different terminology but the idea is there). An item gets zero when fixed or considered not a risk but is deemed worth documenting. So, on our register you get a series of items with weights from 0-9 that is a self ordering list of things to fix. It is pretty simple and you could add more dimensions if you like. I'm just a simple Board member of my company - MD in my case. We try to create to do lists that have a reasonable chance of being fixed with a reasonably simple ordering of importance.

So you'd give this 1 on a scale from 1 to 3? Presumably 3 being the most serious. That doesn't make any sense. If this bug is present, this is instant total control of a PC. That's as bad as it gets.

stordoff 9y ago

Unless OP edited his post, he appears to be scoring it 100 (i.e. it's off the scale).

vardump 9y ago
I misread grandparent post. The scale is 1-3 x 1-3, in other words, from 1 to 9. 0.01 * 100 is 1.
- gerdesj 9y ago
  I was being silly and making quite a few assumptions about readers - which is also daft. This is a really awful snag but it has all ready been patched if you apply them.
- stordoff 9y ago
  Ah, I see. I was reading it as two axes, not a product.
  - gerdesj 9y ago
    Yes a product although the term "two axes" works as well. It's a pretty common way of quantifying "risk" into something that you can tabulate and form a todo list. You list your risks and give each one a score from 0-9 that is made up of "chance of happening" x "business impact or importance or whatever". You could score either as zero as well which will obviously cause the total score to be zero. I'll be changing our Risk Reg soon to become a Risks and Opportunities Register after a discussion in our last ISO 9001 audit. Not sure how the scoring scheme will work for that yet. This may look like a bit of a silly pseudo formal exercise but it really does help with decision making. There's nothing wrong with bending the scores either, if you are open about it. It is simply a way of prioritising a list of things to do in the end. I have to be a PHB sometimes as well as a sysadmin 8)

gerdesj 9y ago

Sorry, I was being silly. Our RR (is not unusual) in having a scoring system. We normally score from 0-9. There are two parts: "How likely is this thing going to happen" and "what will it do". Both parts are given a score of 1-3 and then the scores are multiplied together to get the Risk score (we use slightly different terminology but the idea is there). An item gets zero when fixed or considered not a risk but is deemed worth documenting. So, on our register you get a series of items with weights from 0-9 that is a self ordering list of things to fix. It is pretty simple and you could add more dimensions if you like. I'm just a simple Board member of my company - MD in my case. We try to create to do lists that have a reasonable chance of being fixed with a reasonably simple ordering of importance.