Disclaimer: The opinions of the columnists are their own and not necessarily those of their employer.

Tag Archives: risk management

Classy Data (pt. 3) – Ownership and Risk

September 28, 2009 – 6:00 am – Security professionals proudly describe how they assign owners to their organizations’ data and those owners “assume the risk of any compromise of the data.” Give me a break! The owner is invariably some business-unit manager who just wants to get the job done. The manager will agree to…
By | Posted in CSO/CISO Perspectives, InfoSec Economics, Risk Analysis, Security Metrics | Also tagged , , , , , , | Comments (0)

DHS Security Control May Improve Airport Economy

July 31, 2009 – 5:00 am – It turns out that banning water on airplanes may help improve the vendor economy in airports. The idea is simple. Since passengers may not carry water onto airplanes when boarding, each flight airport hop benefits because passengers need to re-purchase drinks when they land and exit the…
By | Posted in InfoSec Economics, Security in Popular Culture | Also tagged , , , , | Comments (0)

Hope, Fear and Objectivity in National Security: Obama and Chertoff

November 6, 2008 – 6:00 am – Whether or not Barack Obama was your candidate of choice, his Presidency has ushered in a positive response from around the globe. His supporters call this the politics of hope. And, it is in direct opposition to the outgoing US President Bush who’s political tactics are called the politics…
By | Posted in Security in Popular Culture | Also tagged , , , , , , , , , | Comments (0)

The Difference between Quantitative and Qualitative Risk Analysis and Why It Matters (Part 2)

October 29, 2008 – 6:00 am – Objective vs. Subjective Approaches: Strengths and Weaknesses As we have seen, quantitative risk analyses can be subjective and qualitative risk analyses can be objective. The purpose of this slide is to summarize and discuss some of the advantages and disadvantages of both the objective and…
By | Posted in General | Also tagged , , , , , , , , , , | Comments (0)

Governance, Risk Management, Compliance (pt. 1): Form over Content?

September 8, 2008 – 6:00 am – Just a couple of months ago I had a discussion with a colleague, Jim Reavis, on the validity of the recent interest in GRC (Governance, Risk management, Compliance), whereby vendors are peddling systems and services to integrate all three areas. I had said to Jim that I thought GRC was the…
By | Posted in Compliance and Laws, CSO/CISO Perspectives, Risk Analysis | Also tagged , , | Comments (1)