Risk is Not a Primary Metric « The InfoSec Blog

19May/10

Risk is Not a Primary Metric

"Risk" is not a primary metric.

What do I mean by that?
Primary metrics you can measure easily.
In physics they are things like length, weight, temperature, time-duration.
Secondary metrics most people can understand: rate of change that we call speed (length as distance and elapsed time).
Some secondary and many tertiary we can understand intellectually, but they have to be tabulated and calculated - acceleration.
Some such as ENTROPY still baffle people.

My experience with managers is that they often confuse risk for any number of things, not least of all simply equating risk to threats.

The again, I've met managers who would only commission a TVA if it was a contractual requirement, and then they might just ignore it, or if the contract required it, use it obsessively but with no actual understanding. BTDT.

What matters most to managers are things they can measure.

Budget
Completion Milestones
Number of Bugs Fixed
Number of Lines of Code Produced
Worker Attendance
Liabilities concerned with compliance

It takes an enlightened manager to look above and beyond this.
Not least of all because they are judged (and promoted) by "deliverables". Non-tangible deliverables such as 'quality', 'security', 'resilience' are hard to metricate.

We (for various values of in-group membership) may see that and assert that risk can be measured and managed, but lets face it, that's our profession and speciality.