Alex Hutton has been on the leading edge of IT security risk management as long as I have known him. He has a new blog, and if you don’t think we can ever quantify risk, you need to read this post The next age of risk management, science, & craftsmanship:
And that’s the crux of the third age, the move to what I’ve past referred to as a Modern Approach to Risk Management (borrowing heavily from the white page of the same name). Forward thinking programs are blending things like fraud analytics, InfoSec controls, and risk modeling so that there is no longer a boundary between these disciplines. Even folks who are grumpy sticks in the mud about risk, big data and so forth have had to acknowledge the benefits of at least basic “Data Science” methods.
Alex is using some of these techniques in the real world.
I have always challenged any quantitative risk modeler to show me a model that consistently and reasonably accurately predicts security outcomes. A few people are close, but not likely using any of the models you have been taught. Alex and some others, including Jack Jones, are taking a scientific approach and slowly making progress. I expect that some day during my career a model will pass my risk management test, thanks to their hard work.
That will change our profession dramatically.
Reader interactions
One Reply to “Risk Management: Proto-Science”
I wonder if we aren’t chasing a self serving fantasy here. I, like you, would love a scientific approach to risk management; it just feels like a better way to do things.
But is this selfish? I think we need to step back and ask our business leaders and policy makers if they really need us to solve a math problem or more simply provide our expert advice based on experience, intuition and insight.
After all, the point of risk management is to support better decisions which reduce the chance of a bad thing happening or lessen the impact. Maybe there’s a limit to how much we need to understand. Maybe we’re overanalyzing because we can. Maybe this is the new equivilent of the quest to “make things secure”… our perfectionist minds have just found a new area to perfect, at the expense of being “good enough”.