The easiest way to treat a risk is not to.
Risk acceptance is perfectly reasonable in many cases where it would be too expensive or even impossible to mitigate a risk. Exposing a system to the Internet carries substantial risk and yet we do so because that's where potential customers are.
Who has the authority to accept risk? It's down to policy, ownership of systems and ultimately management structures.
Risk acceptance should be a conscious, documented decision and not just lack of action.
(some of) my events
- 2021-09-21--23 Northern European Emergency and Disaster Studies (presenting at conference, Östersund)
- 2020-12-11 Datakommunikation och IT-säkerhet (guest lecturing, Högskolan i Gävle)
- 2020-10-22 Certifierad IT-arkitekt (guest lecturing, Stockholm)
- 2020-10-21--23 Samtidskonstdagarna (attending conference)
- 2020-09-22 RISKUT 2020 (co-hosting conference)
No comments:
Post a comment