When Security Matters
In an environment where security matters all choices made must come down to a risk versus value assessment.
This is true be it my electronic world of bits and bytes, the business word (what services will we provide, and to whom?), even at home (must we keep X in the safety deposit box, or a shoe box in the closet?)
Because of this it is important to understand how to prioritize and respond to security issues logical fashion. Far too many respond with a knee jerk reaction.
Now that we have a premise to work from we one two big questions. How do we prioritize threats, and how do we weigh the associated value?
The Risk Metric
Risk is the most definitive way to analyse how big of a threat you are dealing with. This can be calculated in a number of ways. I am a fan of one of the most basic methods.
Priority * Reliability * Value / 25 = Risk
Priority (0-5) How much harm, and how much of a mess could this risk cause?
Reliability (0-10) How likely is this risk to happen?
Value (0-5) How valuable is what you are trying to protect? This can be in monetary, time, etc.
Risk (0-10) The resulting amount of risk your threat poses.
The Response
After going through the above process for your environment you need to make a decision as to how you choose to respond. Everyone - and every company - has different thresholds for what is acceptable. I highly recommend using a numerical scale based on the risk outlined above, and four categories.
For example:
Risk (0) None. We can safely ignore this as a potential threat.
Risk (1-5) Low. Implement fixes if they are easy and inexpensive. Don't worry about addressing every one of these.
Risk (6-7) Medium. Implement fixes, even if they require expenditure or changes to how work is done. Keep chipping away at these items, as they tend to be the hardest to keep addressed.
High (8-10) High. Fix these items right away. A single malicious person could easily cause a whole lot of problems.