Il senso del Risk Management

Post veramente ben fatto di Bruce Schneier sul Risk Management e sul perché spesso questa attività non venga condotta in modo opportuno.

Solo qualche estratto:

This means balancing the costs and benefits of any security decision -- buying and installing a new technology, implementing a new procedure or forgoing a common precaution. It means allocating a security budget to mitigate different risks by different amounts. It means buying insurance to transfer some risks to others. It's what businesses do, all the time, about everything. IT security has its own risk management decisions, based on the threats and the technologies.

(...)

You can't completely remove emotion from risk management decisions, but the best way to keep risk management focused on the data is to formalize the methodology. That's what companies that manage risk for a living -- insurance companies, financial trading firms and arbitrageurs -- try to do. They try to replace intuition with models, and hunches with mathematics.

(...)

You can't avoid risk management; it's fundamental to business just as to life. The question is whether you're going to try to use data or whether you're going to just react based on emotions, hunches and anecdotes.

Insomma un Risk Management basato sulle emozioni non è molto affidabile.

Aggiungerei che spesso le decisioni di sicurezza sovvertono completamente i canoni di usabilità di un sistema. Che cosa ce ne facciamo di un sistema estremamente sicuro ma anche estremamente inusabile? Forse i posteri porteranno l'UAC di (S)Vista come esempio :-(

Sarà, ma per me l'Availability è anche nel poter usare un sistema in modo opportuno.