Let’s Talk About Risk

A person's perception of risk depends on his or her professional background, gender, age and environment. As a result, IT security practitioners often experience difficulty communicating security threats to executive management. The author examines several factors responsible for varying perceptions of risk, including recent findings in the fields of social psychology, neuroscience and behavioral economics. As a workaround, the author proposes the use of framing techniques to tailor security messages to a management audience. Multiple Perspectives on Risk Risk is everywhere. Analysts and statisticians measure and classify it. Hedge fund managers make fortunes trading it. Security professionals hyperventilate over it. Executives see it as a necessary tradeoff in the pursuit of greater rewards. All of these individuals have different views of risk and what they should do about it. Financial Risk Our success as IT security professionals may depend on understanding that the word risk has a different meaning, depending on a person’s background and training. To people with backgrounds in finance, risk is not always bad. In fact, Merriam-Webster’s dictionary defines the common business strategy of speculation as “assuming a business risk in hope of gain”1. Is it therefore any surprise that some CFOs and CEOs seem immune to IT security’s constant admonitions of doom? How can they develop the business without assuming some risk? In fact, in the financial world, the size of a risk is often proportional to potential gain. This explains why a person with a negative credit history pays a higher interest rate when borrowing money. Rather than simply canceling their risk by lending money only to creditworthy individuals, banks adjust borrowers ’ interest rates to compensate for their likelihood of default. Greater risk means a higher potential return. Security Risk So what does this mean for IT security? It means that, in our efforts to communicate with management, we have chosen terminology laden with some unfortunate baggage. As IT security professionals, our definition of risk better matches Merriam-Webster’s, which 1 “speculation. ” Merriam-Webster Online Dictionary. (2007)