5 ms·
Fully agree that impact x likelihood = risk, although I'd extend it beyond dollars. Impact can include reputation, health, etc. Certainly these could be measure
by austinjp 5y ago
Fully agree that impact x likelihood = risk, although I'd extend it beyond dollars. Impact can include reputation, health, etc. Certainly these could be measured using cash-value as a proxy, but this risks chasing the wrong metric.
I also recognise that "when a measure becomes a target it ceases to be a good measure", and cash as the bottom line risks increasing this tendency.
Too idealistic, probably :)
- faeyanpiraat 5y agoCorps don’t care about your health, they care about you being healthy enough to bring in the dough. And when you accept this fact, you can skip lamenting about all sorts of ethical questions and just know that everything will be a monetary decision in the end.
- aahortwwy 5y agoUsing cash-value as a proxy for impact gives you many benefits. Here are two particularly good ones that are relevant to planning security work: 1. It clarifies your thinking around impact. The simple exercise of sitting down and trying to put a dollar amount on the reputation damage your organization would suffer if Bad Thing were to happen will help you better understand the likelihood and potential consequences of Bad Thing. 2. It allows for more easy comparison to the costs that will be incurred while mitigating the risk. If you think the impact of Bad Thing will be "significant reputation damage", that's bad, but it doesn't help you decide how much time, effort, and money you ought to dedicate to preventing Bad Thing. Blindly chasing metrics can lead to pathological behaviour, for sure, so you need to balance that with strong cultural values, but overall I would say the security industry is terribly heavy on cultural values right now and pays little to no attention to measuring what actually matters to organizations.