The easiest way to treat a risk is not to.
Risk acceptance is perfectly reasonable in many cases where it would be too expensive or even impossible to mitigate a risk. Exposing a system to the Internet carries substantial risk and yet we do so because that's where potential customers are.
Who has the authority to accept risk? It's down to policy, ownership of systems and ultimately management structures.
Risk acceptance should be a conscious, documented decision and not just lack of action.
(some of) my events
- 2021-03-23--25 Northern European Conference on Emergency and Disaster Studies (presenting at conference, Östersund)
- 2020-04-20 Immersiva medier (attending conference, Stockholm)
- 2020-03-18 Certifierad IT-arkitekt (guest lecturing, Stockholm)
- 2020-02-05--08 Folk och kultur (attending convention, Eskilstuna)
- 2019-12-12 Datakommunikation och IT-säkerhet (guest lecturing, Högskolan i Gävle)
last chance...
No comments:
Post a Comment