The Falcon's View

This problem is pervasive across multiple industries, most of which are these days loosely associated with "security" (I heard an ad on the radio last week that Northrup Grumman is now describing itself as a "security services company" - not because they're doing anything different, mind you, but because that's where a lot of the money is... homeland security, national defense and security, cyberwarfare and cybersecurity, etc.). Not that this is any different than ever before, but it seems that you cannot trust much of anything you read or hear these days. If you do, you'll be buying into irrational, FUD-based agendas that seek only to take your money and leave you no better off.

This line of thinking makes me wonder... if you're not particularly experienced with security or risk management, what hope do you have of really dealing effectively with any of this FUD and BS? If some vendor or VAR or consultant comes in making bold statements about "high risk" findings or issues, how do you evaluate and validate what's being said?

It seems to me that every time someone hear's the word "risk" they should immediately jump to a quick interrogation based on the following rubric:
1) Has "risk" been defined in my context?
2) Has the identified "risk" been prioritized within my context?
3) Is the "risk" being used to describe a problem or to promote a "solution"?
4) Has the "risk" been properly weighted against comparable concerns?

If the answers to these questions are inadequate, or simply "no," then you probably have a case of risk abuse on your hands. #3 there is a particular red flag to watch out for, with vendors, politicians, and mainstream media most notorious for flogging "critical issues" with "high risk" that are taken completely out of context and hyped up well beyond anything reasonable. If a vendor sends you marketing materials that talk about "risk" at all, then you should be highly suspicious. How do they know what is or is not a high risk for your organization?

We could go on to talk about how to structure risk profiles and a risk management program, but it's too much at this point. Organizations are failing at the simple step of vetting and validating what they're hearing. Until organizations and people quit accepting all "risk" claims at face value, there's really no point in talking about risk management. Why? Because you won't get the right kind of understanding or buy-in necessary to be successful.

It's time we empower people to challenge blind assertions. It's time to give them the basic tools, such as the responsibility to question what they're told, to begin fighting the rising tide of what is no less than fraud and deceit. Once these basic steps are taken, then we can talk about how to evolve that into a formal risk management program.

Refuse to be terrorized. Refute blind assertions. Question all non-contextual risk statements