tag:blogger.com,1999:blog-10259481.post269671348640522906..comments2023-10-30T09:25:19.881-05:00Comments on Joel Esler: Is "X" a security risk?Joel Eslerhttp://www.blogger.com/profile/05018134738510159518noreply@blogger.comBlogger2125tag:blogger.com,1999:blog-10259481.post-81690631038361933182008-06-04T07:07:00.000-05:002008-06-04T07:07:00.000-05:00I left the same comment below on the blog posting ...I left the same comment below on the blog posting you referenced.<BR/><BR/>***<BR/>The technology itself is not a risk. The loss forms that can result via use of the technology is where risk (exposure to loss) comes into play. For example, in the context of unauthorized / malicious data leakage, a company would need to:<BR/><BR/>1. Determine which internal employees / contractors could be threat agents (or part of threat community).<BR/>2. Understand & evaluate its existing security controls.<BR/>3. Estimate how often these threat agents attempt to disclose data<BR/>4. Estimate how often the threat agents are successful (are able to overcome the security controls).<BR/>5. Estimate the amount of damage – in terms of dollars – the company has incurred.<BR/><BR/>Within the information security profession, we tend to use the term risk – whether unintentionally or intentionally - as a placeholder for components that actually make-up risk – all to often to reflect the vulnerability aspect of a given technology or practice without fully understanding the risk.<BR/><BR/>I highly recommend the FAIR methodology (http://www.riskmanagementinsight.com/) for better understanding the elements that make up risk but for also trying to quantify risk.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-10259481.post-67569345049444177102008-06-03T20:18:00.000-05:002008-06-03T20:18:00.000-05:00Going from private sector, to DoD, and now back fr...Going from private sector, to DoD, and now back from the Third Reich I can say user education rests solely on those who want their network/resources in better shape than they currently are. It's pretty easy to say a lot of the mantras and perscribed diatribes that accompany most IT/Security positions, however, it's much more fulfilling and ultimately better business practices to develop policy, educate, and enforce. Sure, you wont hit everyone, nor should you expect to. You will provide your network and your user base more functionality at the cost of peace of mind. Yeah, I can dig on that.Chandler Bassetthttps://www.blogger.com/profile/01647599570970884682noreply@blogger.com