NOVEMBER - 2019ENTERPRISE SECURITY| | 19The Importance of Quantifying RiskBy Jamie Samans, Director, Information Systems Security, American Institutes for Researchour organization has a clear mission and a solid strategy, plus a comprehensive risk management program. However, people are constantly reacting to the effects of uncertainty, and even after years of diligent assessment, risk treatment decisions seem arbitrary. Why? One reason may be a reliance on qualitative analysis.Global standards such as ISO 31000 and frameworks developed in the public and private sectors provide guidance and techniques. Identifying risk can be time-consuming and complicated, in part because of the sheer volume of business processes and their interdependencies. However, given time and attention, a typical organization can do a reasonably good job of identifying its risks.Analyzing the risks that we identify is a different matter. Where identification is a mature process, analysis is a discipline in transition. It is widely understood that what gets measured is what gets managed. Less emphasis is placed on how measurement is done, yet it matters greatly. Across the major standards and publications, we are told that qualitative rankings (such as high, moderate, and low) are at least acceptable as quantification and may even be preferable. Why take time to try and puzzle out the dollar-value of a process or information asset when you can rate it "high"? Why calculate the true probability of a hurricane or a ransomware attack if you can call it "moderate?" That's the approach that many organizations take, and it goes a long way to explaining why all the time, money, and effort put into risk management doesn't seem to be able to manage risk at acceptable levels.Qualitative assessments are highly effective when the goal is to rank-order something within a context. An expert in a given department can reliably say which assets are of high importance and which are less important, and we can trust that judgment. The problem is not a lack of expertise. The problem is what happens when the context shifts. The high-value assets in one business function may not be as important to the organization as those in another. Even if the loss of the assets in each CXO INSIGHTSY
< Page 9 | Page 11 >