Читать книгу You CAN Stop Stupid - Ira Winkler - Страница 42

People often mistakenly assume that “mitigating loss” means preventing all potential loss. That is impossible. There will always be some form of loss in operations. Perhaps one of the best definitions of risk is this one from ISO 27000:

Risk is the effect of uncertainty on objective.

Similarly, we want to be careful about what we mean when we discuss “optimizing risk.” People generally believe that minimizing risk implies you should spend whatever it takes to avoid as much risk as possible. Trying to prevent all risk and loss might cost more to achieve than the actual loss you hope to mitigate.

What you are actually trying to do is manage the loss. The concept of balancing potential loss with the cost of mitigating it is called risk management.

As this book specifically addresses user-initiated loss (UIL), including malice and other potential forms of loss, you need to not just understand the concept of risk management as a whole, but also consider it in the context of mitigating the risk that is inherent in users.

This means you need to open your mind to potentially changing workflows and reducing some capabilities of users within your organization. While there may be some pushback against doing this, the reality is that while you are removing the ability of users to initiate loss, you are also simplifying the process and making it more efficient at the same time. In Chapter 1, we discussed the timers for cooking at McDonald's. Removing the discretion of the cooks delivers a more consistent product while reducing the potential stress for “eyeballing” properly cooked food and the inevitable reprimands when food is undercooked or overcooked.

In a traditional white-collar environment, there is usually concern about reducing the capabilities of an employee. However, the capabilities being removed are often those that are unneeded or unused. For example, many organizations provide employees with PCs and knowingly or unknowingly provide those employees with administrator access to their PCs. Having administrator access can enable the employee to potentially make more use of the PC, for example by giving them the ability to load new software, perform preventative maintenance, and so on. However, not all users will perform preventative maintenance how and when they should, and the software they load can create security vulnerabilities due to its source, its configuration, and so on. As a result, having users with admin access also opens the door to more ransomware attacks. In theory, the organization should have a process in place for acquiring software and performing maintenance (generally managed by a technology, security, or management department). Consequently, there are fewer benefits to users having administrator privileges, and those are outweighed by the potential loss.

These are the types of decisions that you have to make during the process of “stopping stupid.” You need to weigh the benefits of giving users specific capabilities against the potential loss those capabilities might cause. This requires a consideration of risk. The better you understand risk, the better you can make such determinations.