Risk Management: Is It Needed?

Introduction

Within computing environments, risk management has become a widely used phrase to describe how we determine a suitable level of investment in security (Hopkin, 2018). Often risk management has been characterized as the antithesis of risk avoidance – the investment of whatever resources is necessary to eliminate any risk. Risk avoidance is really just one style of risk management. Total risk acceptance can be viewed as the opposite style of risk management to risk avoidance. Both deal with strategies for managing the various elements of risk to fit within an acceptable range along a continuous spectrum of risk. Likewise, both provide an approach for dealing with the fundamental risk management decision . . . “How best do I invest my constrained, available resources among a variety of alternative options to best accomplish my assigned mission in a potentially hostile environment?”

Sometimes this investment decision is portrayed as a contest between investment in functionality or security (Boranbayev et al., 2022). They are treated as if functionality and security are independent of one another and measured against different requirements (Boranbayev et al., 2022). This is a poor portrayal of the risk management decision since most computing systems are required to be operational in varying degrees of a hostile environment. Within a hostile environment, it is often the investment in security measures that allow there to be any functionality at all. A better portrayal of the risk management question would be the determination of the proper balance of the costs and benefits derived from any system feature (functional or security) to the success of the mission in the operational environment. How much functionality or how much security is in a system is NOT the ultimate measure. Operational mission success is the fundamental yardstick of any risk management decision.

Because of its widespread application within various industries, this chapter provides a basic reference guide to fundamental concepts of risk management. This chapter will introduce the concepts of:

• •

  What is Risk and Risk Management?

• •

  The Cyclical Risk Management Process

• •

  Risk Analysis

• •

  Types of Risk Analysis

• •

  Risk Acceptance Strategies

• •

  The Risk Management Infrastructure

• •

  Roles and Responsibilities – The Risk Team

Is Risk Management Needed?

To understand the purpose and role of Risk Management, we must first understand the notion of risk. Sometimes risk is referred to as the harm that can occur as the result of different actions. At other times we use that term to mean the likelihood of a harmful event happening. Risk is sometimes used to mean the characteristics of a system that are being exploited or even used to mean the source of a hostile action. At times we even try to define risk in terms of a specific mathematical function. Risk and risk management are many things to many people. In practice, we do not have a common understanding of risk nor a common approach to risk management.

So, what is Risk? At its most fundamental level:

And what is Risk Management?

And what are Risk Management Decisions?

These basic concepts become more and more complex as we try to provide more rigorous definitions to what is meant by HARM, LIKELIHOOD and how those notions are COMBINED to form the notion of RISK, however, to establish a common approach to addressing risk, we need to develop a common: