Access your Pro+ Content below.
Marcus Ranum and Bob Blakley discuss risk management failures
This article is part of the Information Security magazine issue of June 2011
Marcus Ranum: Let’s jump right into this, shall we? You know I’ve been a pretty vocal skeptic of the idea we can manage risk in computer security -- especially since we’d have to understand risk first and it doesn’t seem like we do a good job of that. It seems almost unfair to point to nuclear accidents and Wall Street crashes as examples of risk management failures, but, really -- is that unfair? Bob Blakley: You’re joking, right? Of course it’s fair to point out that these things were failures of risk management. Take Chernobyl. The Chernobyl accident has certainly already cost more than the value created by the Chernobyl reactor over its lifetime, and the costs will keep adding up for the foreseeable future. Furthermore, the accident imposed costs on people who had nothing to do with the reactor’s construction, did not benefit from it, and were not given any say in any decision regarding its construction or operation. This is the textbook definition of a risk management failure – an incident that causes an entire initiative ...
Access this PRO+ Content for Free!
Features in this issue
In order to get the best results, you need to limit your goals for SIM.
The influx of personal smartphones and other computing devices into the enterprise is forcing a shift in security strategy.
An automated tool and mandates for continuous monitoring try to improve federal information security efforts.
Sony and other data breaches suggest need for data accountability, better configuration management.
Columns in this issue
Online criminals have smaller targets firmly in their crosshairs.
Banks and other businesses are rushing to jump on the mobility trend but leaving security behind.
Security expert and Information Security magazine columnist Marcus Ranum continues a new bimonthly feature where he goes one-on-one with a fellow security industry insider.