We like to think of Security Risk Management as an objective practice. After all - if stakeholders are expected to foot the bill for mitigating risk, they will want to base such a decision on solid ground. They need facts, don't they?
Hold it right there.
What is a fact about risk? Risk concerns potential future events. What facts do we have about the future? That's right. None, whatsoever.
So, in the absence of facts - what can we offer? Is there such a thing as an objective risk assessment?
(some of) my events
- 2020-03-10--12 Northern European Conference on Emergency and Disaster Studies (attending conference, Östersund)
- 2020-02-05--08 Folk och kultur (attending convention, Eskilstuna)
- 2020-01-16 Certifierad IT-arkitekt (guest lecturing, Stockholm)
- 2019-12-12 Datakommunikation och IT-säkerhet (guest lecturing, Högskolan i Gävle)
- 2019-11-21--22 Samlingsforum 2019 (attending conference, Nyköping)
last chance...
