There is an interesting quote by Nobel laureate Joseph E. Stiglitz in the September 23, 2009 issue of the New York Times. In an article on the first page of the Business Day section by Peter S. Goodman, with the title “Emphasis On Growth Is Called Misguided,” Stiglitz is quoted as saying the following:
“What you measure affects what you do … If you don’t measure the right thing, you don’t do the right thing.”
One Comment
Great points, Warren!
I suggest that common measurements of the value at risk are also flawed. The valuation is usually done only from the perspective of the asset owner or possessor. Ignoring the value of the asset to potential adversaries is a mistake.
An enterprise may view a collection of personally identifiable information as moderate in value and protect it accordingly, while an adversary may place a much higher value on it, and thus be willing to spend more to compromise the safeguards than the enterprise is willing to spend on protection.
-Randolph