Where I think your comments bear tempering is with regards to the amount of data we need. I think our friends from RMI would point out that in the world of Bayes, we don’t need a whole lot of data. Hence, FAIR makes for nice risk measurement. Combine this with your favorite CMM and off you go.

All this being said, I think we agree that the model is broken; that we need a new way of thinking. People simply do not get tech risk n the same way that they get physical risk. And, even then, we see disproportionate focus on low probability events instead of the high probability events. :S

I am certainly not saying that Risk Management is bunk. I’m a *strong* believer in RM and the CMM discussed in the post. I just think we need to alter our perception of RM from that of a scalpel to that of a beef cleaver. We always want the best for out people but end up facing the world of emotion and irrational thought.

What is it that goes into our metrics? When we ask someone, “what application is the most critical to your business?” many say E-Mail! Though it may be important, I’d rather say the systems that keep the cash flowing are more important. I agree that we need to guide people in the right direction, but what is that right direction? With different business units touting different needs for a very limited number of resources, who is to say what the “right” direction is?

I’d love to live in a world where we all have infinate volumes of information at an infinate level of understanding, but we do not. So, just like many CEOs, we must make decisions based on the info we have at hand and our go with what the data and our gut tell us. Sadly, this is not a perfect approach.

I advocate for better data, better information, and better guidance for the masses so they can make better risk based decisions.

As for the PCI DSS, you know I feel that it is *one* good approach, but I also feel there are many others. If a company has a sound risk management method that focuses on the protecting against the electronic and paper theft of payment card data, they are fulfilling the spirit of the standard. The path to this goal may come in many forms.

In the spirit of your post, however, I’d acquiesce that we need to be doing something different. This is where I find the PCI DSS such an egregious regulation. It doesn’t really move us forward toward addressing the long-term issues. In fact, it seems to barely scratch the surface of the short-term issues. Breaches keep happening, and they keep getting bigger – hardly an endorsement for the standard.

What we need is a complete shift in thinking, a move to a different model, that accomplishes the long-term goals without using the same old mantras and carrots.

Visit and let us know what you think.
Enjoy
-Andreas