Replacing Risk Management with Pure Awesomeness

Allow me to set the stage to pose to you something I’ve been thinking about the past few days. Specifically, have you ever noticed how sometimes certain situations tend to favor the ignorant? Follow the logic with me on this… Risk management is about increasing your risk-awareness, right? Now, by “increasing your awareness”, I mean that you try to understand what your current risk profile is, you set a tolerance threshold for how much risk you feel you can absorb, and you actively work to remediate any risks that are above the threshold. The process involves understanding your current situation, making a decision about it, and moving on. Now, most of us would tend to assume that understanding your current position is desirable. You’d think so, right? For the organization as a whole, it’s probably all upside. The organization is better off understanding where they stand and making intelligent decisions. But what about on an individual level? I mean, are individual employees and executives incented to move to this model?

Compare two different companies: say Company A goes through the risk management process. they find an issue that introduces risk; but for whatever reason, they don’t remediate it. Maybe they decide that the risk isn’t worth the likelihood it will be exploited; maybe they don’t have budget to fix the problem. Whatever the reason, it doesn’t get fixed. Now, Company B is a “fly by the seat of the pants” kind of company; they haven’t even heard of risk management, let along employ it. They don’t have any clue about what problems they may or may not have. Say, hypothetically, they both get hit by the same problem – company A knew about it but didn’t do anything while company B had no clue it was an issue. Who’s better off? Both companies suffered the same damage, right? Both companies are in a world of hurt and need to take action… But at a micro level… at the level of the individual would you prefer to be in the position of knowing about an issue and not acting or in the position of not knowing? After all, somebody could come around with the benefit of hindsight and say “you KNEW that this problem could occur but yet you elected to IGNORE it” or “who EXACTLY made the decision that this issue costing us x million dollars wasn’t a priority?” Yes, somebody in Company A is probably going to be looking for a new job sooner rather than later, don’t you think? Company B, on the other hand? Instead, they’re saying, “Gee, who knew that could happen? How could we possibly have known?” Force Majure… Another day at the office…

Now, I happen to think risk management is the right way to do things. I don’t understand how people can possibly plan if they don’t know where they are today. But I think there’s something more to it… there needs to be a reason for executives to want to push risk management. And today they arguably have reasons not to (or at least to be nervous about it.)

So, it was with this in mind when I came to reading Pete Lindstrom’s blog entry from yesterday where he references the Donn Parker article suggesting we get rid of risk management. Now, when I read Pete’s reference to this, I was actually somewhat hopeful… Given what had been on my mind, I thought maybe Donn was going to come up with some straight dope on the issue. Needless to say, I was disappointed. So Donn’s take is that we should take risk management and replace it with “unbelievable greatness – with the goal of total and unadulterated awesomeness”. Well, maybe that’s not exactly what he said… but it’s close. What he actually said was that we need to replace risk management with “practical, doable security management” with the goal of “due diligence, compliance consistency, and enablement.” Here’s the problem with this line of reasoning – “risk management” is a methodology – a process. Having “doable, practical security management” is a state that you come to as a result of some process – not a process itself. One could say, for example, that a potential outcome of risk management as an approach would be having practical, doable security management whereas one could not say the inverse. For example, if I said that instead of driving my car that I wanted to be at my destination. That wouldn’t make sense, right? To get to my destination, I need to go through some process. Driving is one option, as is walking, flying, crawling, hopping, skijoring, etc. Anyway, my goal here wasn’t to diss Donn – he actually makes quite a few interesting points, not the least of which are critiques about how risk management is currently practiced in enterprise. All valid criticisms. But it wasn’t what I was hoping for.