{"id":35816,"date":"2020-06-30T12:57:58","date_gmt":"2020-06-30T12:57:58","guid":{"rendered":"https:\/\/blog.trendmicro.com\/?p=543983"},"modified":"2020-06-30T12:57:58","modified_gmt":"2020-06-30T12:57:58","slug":"risk-decisions-in-an-imperfect-world","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/risk-decisions-in-an-imperfect-world\/","title":{"rendered":"Risk Decisions in an Imperfect World"},"content":{"rendered":"
<\/p>\n

Risk decisions are the foundation of information security. Sadly, they are also one of the most often misunderstood parts of information security.<\/span><\/p>\n

This is bad enough on its own but can sink any effort at education as an organization moves towards a DevOps philosophy.<\/span><\/p>\n

To properly evaluate the risk of an event, two components are required:<\/span><\/p>\n

    \n
  1. An assessment of the impact of the event<\/span><\/li>\n
  2. The likelihood of the event<\/span><\/li>\n<\/ol>\n

    Unfortunately, teams\u2014and humans in general\u2014are reasonably good at the first part and unreasonably bad at the second.<\/span><\/p>\n

    This is a problem.<\/span><\/p>\n

    It\u2019s a problem that is amplified when security starts to integration with teams in a DevOps environment. Originally presented as part of AllTheTalks.online<\/a>, this talk examines the ins and outs of risk decisions and how we can start to work on improving how our teams handle them.<\/span><\/p>\n