When possibility is all you have.
Recently I was placed in the position of having to do a quiet risk assessment of my own. After the fact, going through the FAIR loss event frequency branch of the framework, I found that I had mentally filled in the following:
Contact = constant
Action = who knows?
Control strength = this is the knob I had to tweak in my decision: how much control strength to apply. The settings were 0, 50, and 100.
Threat capability = 100 percent, if I didn’t change the control strength.
It occurred to me that “Action” may be equivalent to “motivation.” If they had the capability, and could do it at any time because they had constant contact (or access, which isn’t the same as actually making contact), what was the probability of them doing it? How motivated would they be?
I had absolutely no way of figuring this out without killing Schroedinger’s cat, so to speak. I knew the level of motivation was non-zero, but that was all I had to go on. I also knew that the act of my setting the Control Strength higher than zero would possibly affect the motivation level, for this event and for other possible events.
So based on my estimation of Probable Loss Magnitude, I put that together with the possibility of Action, and cranked the Control Strength to 50. 50 made the Probable Loss Magnitude close to zero, based on our recovery capabilities, but it might also have raised the probability of Action. (If it’s a loss and you can recover in a trivial amount of time, is it really a loss? Or is it just having a stick poked in your eye?)
My dreaded event did happen, and we recovered just fine. But my eye’s a little sore.
Posted by shrdlu on Thursday, May 24, 2007(1) Comments • Permalink •
