So at the risk of throwing my IT friends under the bus, I agree with the author on his conclusion, but maybe not the way he came to the conclusion.  There are different types of threats faced by the IT world. Some have probabilities that are much better defined than others - e.g. how often do certain types of network switches of a certain manufacturer with a certain type of data flow fail? For those things, the industry really needs to move on past the basic risk matrix, because they have better data now. There's also a resilience question that needs to be answered for some things - for instance, if you have a failure, what impact will it have on the end user? If the answer is unacceptable, you have to add mitigating factors to increase your ability to bounce back (resilience). You start the conversation with a basic risk matrix, but then you move on to other tools to help evaluate failure modes. Now, the throwing them under the bus part-parts of the industry just aren't that good at this yet. The technologies have been moving so fast and the threats have been evolving so quickly that they are having difficulty evolving the risk methods described in their consensus standards. The information protection part of the industry that he describes in the essay is in my opinion one of the least defined parts of this industry. 

Previous post   |  Top of Page   |   Next post