It is interesting that there is no equivalent term in Latin for risk outside of the word for danger. While security is the state of being free from danger or threat, risk, is a more complex topic and cannot be addressed without the concept of loss. It is the probability, not merely the possibility of something unpleasant or unwelcome happening that will result in a loss of some kind (life, liberty, property). The term did not even come into existence until the 17th century after the Medici had leveraged eastern mathematics in the calculation of probability in financial terms and still the word risk is derived from the word danger. Big mistake! Danger is a static concept. It simply implies a threat. Risk quantifies it so you can make intelligent decisions. If you are a military strategist, you calculate risk in terms of loss of life and resources against mission objectives. For most of us business is not usually calculated in terms of loss of life but rather in terms of financial efficiency. To be certain this is not an absolute statement. Loss of life against financial efficiency is always present in operational decisions but for the sake of risk in the IT world we, for the most part confine ourselves to financial considerations. Loss of life limb and property all are quantifiable in monetary terms. We always say that loss of life is unacceptable but consider that 33,963 people lost their lives on American highways last year and the National Highway Safety Administration did not call for the closing of all highways. As humans we always weigh risk against reward and therein lies the monetary connection. How should we approach risk in terms of Information Technology? How should we manage risk? I submit that risk management is the set of decisions and actions that reduce the cost of IT. After all, IT security is an overhead expense. IT security does not make a company money. Having an IT infrastructure is a requirement for e-commerce (for example) which enables a company to access a wider market and drives revenue. IT infrastructure has an ROI. The company could confine itself to a chain of physical stores and that infrastructure would represent an ROI but it would be less because the market that physical stores address is smaller and the cost of physical stores is higher. The cost of securing a physical store, however is cheaper than the cost of securing and internet presence so therein lies the motivation behind IT security in this case....REDUCE COST! A technology that enables a company to increase its revenue base has ROI value. A technology that reduces the cost of acquiring that same revenue has RR (risk reduction) value. The tragedy is that most organization fail to quantify and therefore fail to achieve meaningful RR.
Cybersecurity