Apart
from certain limited circumstances, most “real world†information risks cannot
be objectively, rationally and accurately calculated or measured
mathematically. We're dealing with an unbounded problem space and imperfect
knowledge of it. At best some “knowable†risks can be estimated and ranked, but
even this process is critically dependent on how the risks are framed or scoped
(including how risks or information assets are accumulated or grouped
together), and on who does the assessment and how, while other “unknowable†and
hence unpredicted risks are almost certainly Out There waiting to bite us on
the bum (which is what contingency planning is all about). It's a matter of
probabilities and complex interdependencies so simple mathematics don't help:
risks aren’t simply additive or accumulative.
But
that is not to say that risk assessment, measurement and comparison is totally
pointless, rather that the results should be treated with a great deal of
caution since there are clearly significant margins for error. Large
differences in calculated probabilities or impacts of certain information risks
and incidents may be meaningful, whereas small differences may not. Where you
draw the line between big and small is down to your own experience in this
area, your trust in the numbers and analysis, the reasons for differentiating
them, and gut feel.
There
is a perspective effect too. From a senior executive’s point of view, impacts
that involve them personally going to prison, being demoted or sacked, or
suffering big hits on their executive bonus schemes through stock price
crashes, are likely to register, even when probabilities drop from “probableâ€
to “possibleâ€. Compliance with laws and regulations tends to fall into this
category. From an individual data subject’s perspective, impacts involving
unauthorized disclosure of their most personal details are likely to be off the
scale yet they may not understand or be concerned about probabilities.
And
there’s still more to consider in terms of selecting appropriate risk
treatments. Few information security controls absolutely reliably and
comprehensively mitigate risks. Even “strong†encryption is fallible, often due
to implementation or key management flaws and sometimes due to cryptanalysis or
blind
luck. Most risk treatments help to reduce if not eliminate specific risks, and
a few (such as contingency planning and having effective ISMS) help reduce
unspecified risks.
User questions & answers