What Is Risk Management?

Risk management, exemplified by the Death Star's overlooked vulnerability in Star Wars, emphasizes understanding and addressing even the smallest risks. Effective risk management combines both broad qualitative assessments and detailed quantitative evaluations.

Sleek v2.0 public release is here

Lorem ipsum dolor sit amet, consectetur adipiscing elit lobortis arcu enim urna adipiscing praesent velit viverra sit semper lorem eu cursus vel hendrerit elementum morbi curabitur etiam nibh justo, lorem aliquet donec sed sit mi at ante massa mattis.

  1. Neque sodales ut etiam sit amet nisl purus non tellus orci ac auctor
  2. Adipiscing elit ut aliquam purus sit amet viverra suspendisse potent i
  3. Mauris commodo quis imperdiet massa tincidunt nunc pulvinar
  4. Adipiscing elit ut aliquam purus sit amet viverra suspendisse potenti

What has changed in our latest release?

Lorem ipsum dolor sit amet, consectetur adipiscing elit ut aliquam, purus sit amet luctus venenatis, lectus magna fringilla urna, porttitor rhoncus dolor purus non enim praesent elementum facilisis leo, vel fringilla est ullamcorper eget nulla facilisi etiam dignissim diam quis enim lobortis scelerisque fermentum dui faucibus in ornare quam viverra orci sagittis eu volutpat odio facilisis mauris sit amet massa vitae tortor condimentum lacinia quis vel eros donec ac odio tempor orci dapibus ultrices in iaculis nunc sed augue lacus

All new features available for all public channel users

At risus viverra adipiscing at in tellus integer feugiat nisl pretium fusce id velit ut tortor sagittis orci a scelerisque purus semper eget at lectus urna duis convallis. porta nibh venenatis cras sed felis eget neque laoreet libero id faucibus nisl donec pretium vulputate sapien nec sagittis aliquam nunc lobortis mattis aliquam faucibus purus in.

  • Neque sodales ut etiam sit amet nisl purus non tellus orci ac auctor
  • Adipiscing elit ut aliquam purus sit amet viverra suspendisse potenti
  • Mauris commodo quis imperdiet massa tincidunt nunc pulvinar
  • Adipiscing elit ut aliquam purus sit amet viverra suspendisse potenti
Coding collaboration with over 200 users at once

Nisi quis eleifend quam adipiscing vitae aliquet bibendum enim facilisis gravida neque. Velit euismod in pellentesque massa placerat volutpat lacus laoreet non curabitur gravida odio aenean sed adipiscing diam donec adipiscing tristique risus. amet est placerat in egestas erat imperdiet sed euismod nisi.

“Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum”
Real-time code save every 0.1 seconds

Eget lorem dolor sed viverra ipsum nunc aliquet bibendum felis donec et odio pellentesque diam volutpat commodo sed egestas aliquam sem fringilla ut morbi tincidunt augue interdum velit euismod eu tincidunt tortor aliquam nulla facilisi aenean sed adipiscing diam donec adipiscing ut lectus arcu bibendum at varius vel pharetra nibh venenatis cras sed felis eget dolor cosnectur drolo.

What Star Wars Teaches Us About Risk 

What do you think of when you hear the word “risk?”  YOLO leveraged bets into companies without a competitive moat or healthy balance sheet? Squirrel suit base jumpers with a death wish? I think of Star Wars and the mighty but vulnerable Death Star. As that story illustrates, humans struggle with vast, nuanced data, making risk management challenging. As Nicolas Taleb highlights, we're often "fooled by randomness," leading to suboptimal strategic decisions.

The Mighty but Vulnerable Death Star

The Death Star: a colossal asset with the power to obliterate entire planets and bring the rebellion to its knees, but it was not without its Achilles' heel - a seemingly insignificant thermal exhaust port.

An analysis of the plans provided to the Rebellion by Princess Leia demonstrated a weakness in the battle station … only two meters wide, [there] was a small thermal exhaust port, right below the main port. AND ... the shaft led directly to the reactor system.

This obscure vulnerability, when overlooked, spelled immense disaster for the Empire.

As you recall, this is the three-part story of how the saga played out (Threat, Control, and Exploit):

The Rebellion had a brand new X-Wing pilot who used to bullseye < 2 meter length womprats in his T16 back on his home planet of Tatooine.

But Upper management in the Empire, led by Tarkin, with the help of his GRC team had designed and implemented controls to neutralize threats like X-WIngs.
Vulnerability? Prime for exploitation. Force-driven Proton Torpedos, making impossible bends resulting in a severe threat incident.

Bad Risk Management Has Consequences

It’s a poignant reminder for us that ignoring even the smallest of risks can have monumental repercussions. Just for fun, if we were to quantify the loss in Star Wars currency, it would be an eye-watering 92 sextillion intergalactic planetary credits! That’s called a catastrophic event.

An incalculable loss in a galaxy far far away that someone on the internet actually calculated for us. The internet has an answer for anything.

The Three Pillars of Risk Management

Effective risk management is anchored by three foundational elements:

Inherent Risk - Both the inherent likelihood and the inherent impact of a threat exploiting a vulnerability without any controls in place.

Risk Treatment - Strategies that encompass modifying and refining processes, as well as sharing, transferring, or directly embracing risks.

  • Mitigate: Minimize the risk with controls and/or enhancements.
  • Share: Divide risk via partnerships and/or collaborations.
  • Transfer: Delegate risk using insurance and/or outsourcing.
  • Accept: Recognize risk, a deliberate decision, and implement no control.
  • Avoid: Don’t proceed with or discontinue activity.

Residual Risk - Both the inherent likelihood and the inherent impact of a threat exploiting a vulnerability with controls in place.

Qualitative vs. Quantitative Risk Assessment

While qualitative assessments are beneficial for a bird's-eye view, they might lack the intricacy needed for precision. I've always believed that a mere label like "high" or "low" might not always encapsulate the entire story.

This is where quantitative assessments come into play, diving deeper and harnessing data to get a clearer picture of risks. Here's a useful formula:

Risk Impact (R) = threat (t) × vulnerability (v) × assets impacted (a) × probability (p)

By applying this, we can glean invaluable insights, which in turn can guide us to reassess and refine our risk strategies. Risk assessments are not meant to be precise. We are trying to get an idea of the relative importance of certain risks, so that we can be wise stewards of the resources we've been given. 

The Galactic Lessons on Risk

The Death Star, with its vast power, had a seemingly miniscule yet fatal vulnerability: a tiny thermal exhaust port. This oversight teaches us that in risk assessment, it’s crucial to recognize all vulnerabilities, no matter how small. It emphasizes the importance of combining broad qualitative assessments with detailed quantitative evaluations to ensure no threat, regardless of its size, goes unnoticed. 

The Future of Risk Assessment

The best risk managers in the future will look and perform a lot like the best risk managers of today. In risk management, Experience will always matter. Data will always matter. So we'll continue to use a mix of Qualitative and Quantitative Risk Assessment. But AI will likely give each risk manager their very own C-3PO.

Real-World Applications and Further Reading

Proactive measures are essential in safeguarding against potential threats. This point is starkly underscored by Kaspersky's 2021 Incident Response report, which reveals that unpatched vulnerabilities top the list as the primary vector for attacks. Such vulnerabilities pose a critical risk that organizations must manage. Ensuring that your systems are regularly updated and that patches are applied promptly, especially to internet-facing devices, is not just good practice—it's a crucial defense strategy.

For a deeper dive into the significance of these findings and to learn how your organization can prioritize and address vulnerabilities effectively, read the Debra Baker's detailed insights from the 2021 Kaspersky State of the Cyber Incidents Report.

For additional reading on risk management, check out our article about why security measures fail.

About the author

Kenny is an accomplished leader with a 16-year tenure in Information Security and IT Audit. He's widely acknowledged in the industry and has a profound dedication to it. In addition to his technical expertise, Kenny's portfolio includes substantial experience in business strategy, investment, and programming.‍ On the personal side, Kenny is a devoted husband to Angie Scott and a proud father of five. A music enthusiast, he relishes playing the guitar and enjoys surfing when a beach is within reach.