My colleague Gary Hinson made the following observation on the ISO 27001 list in August:
There are numerous assumptions and estimations in the risk
assessment process, so all calculated values have quite wide margins
of error. Worse still, there are almost certainly risks or impacts
that we have failed to recognise or assess, in other words we need to
allow for contingency.
Oh,its worse than that!
The problem is that the potential perpetrators are the ones that determine “the most significant risks” of which you speak, in both frequency (when they decide to strike) and impact (how much damage they will do and what they will do with the results of their attacks), not the person performing the risk analysis.
We are debating how to value an asset, book value, replacement value or the value of the process of using it. Well that doesn’t matter; its the value to the perpetrator of the attack at counts. What you value and defend might be of no interest to him (or her). Obtaining the desired asset may result in collateral damage.
So long as you focus on a Risk Analysis model rather than a comprehensive plan of diligence and security stablemen you are going to get caught out by these false assumptions.
Face it: the Risk Analysis approach means you have no idea who and where the potential perpetrators are, rational or irrational; when and how they may strike (with a tank, an army, or with false data entry).
But act and calculate as if you do.
You have no idea of the perpetrator’s
- skills
- knowledge
- resources
- authority
- motives
- objectives
but the Risk Analysis approach presumes that you do.
I’m sorry, this doesn’t make sense and hence arguing about how to calculate the value of an asset doesn’t make sense in this context. Its like arguing over how many angels can dance on a pinhead when there’s war and famine going on outside.
Related articles by Zemanta
- Step 1b for defining your fans and customers (flowingmotion.wordpress.com)
- The Pirates Are Getting to the “Better” Part of Their Rotation (bleacherreport.com)
