You’ve just moved from Arizona – where you were in the habit of walking the short mile to work and back in a wide-brimmed hat, sunglasses, SPF-15, and loafers – to Seattle, where you plan to continue the practice.
Being cautious, however, you decide to use the traditional risk model to calculate how much damage the Pacific Coast rain might cause. So, you first identify the likelihood of rain and find that it rains about 42% of the time, averaging 152 days a year.
Likelihood: 42%
Seems like a reasonable risk, so you set off confidently.
Naturally, you’re soon in the lobby, your soaked and bedraggled new suit in need of reshaping. The loafers are brimful after that bus hit the puddle just right. Your I.D. papers and the company handbook were in a pocket and will need to be replaced, and you’re juggling the apple, sandwich, and cookies which broke through their soggy paper sack. Security is eyeing you suspiciously.
Aside from self-respect, and the bad first impression you’ll make at the office – what we call ‘submerged’ risk, which we’ll discuss later – the actual damage is about a hundred bucks.
Magnitude: $100
Using the classic model, we now have the equation:
The Vulnerability Model
But the model above is incomplete. It identifies bad things that could happen, certainly, and it tells you how expensive the outcome will be if they do. But it doesn’t account for vulnerability.
Unlike Likelihood – an external phenomenon not in your control – vulnerability is internal, something you can manage. (Magnitude is a combination of factors. Some costs of damage may not be in your control while, as we’ll see below, there are ways to control and minimize magnitude.)
Let’s reset the above scenario. As you’re walking out the door in Seattle, you grab an umbrella and set off down the street to go meet the team.
This won’t impact the likelihood of rain at all, so the level of threat is still the same 42%.
External Threat Level: 42%
However, your umbrella has dramatically reduced your vulnerability to a rain shower. Only a major downpour, heavy winds, or an umbrella failure, can seriously damage you now. Collectively, you calculate, the chances of one of those happening is around 7%.
Vulnerability: 7%
You can also reduce the magnitude by protecting certain specifically vulnerable areas. Rubber boots or overshoes for your loafers; a raincoat for the suit, and a waterproof valise for documents, will limit potential damage greatly. Your protection isn’t perfect, and if the umbrella fails you’ll get wet here and there, but you will still arrive at the office in good condition. You might have lost the lunch, and your trousers will need pressing, a total of about twelve bucks.
Magnitude: $12
Now we’re talking! The risk has been reduced dramatically.
This is how things generally work. Most people understand there are basic vulnerabilities and that they can protect against most of them. But they don’t always do the work to assess their level of vulnerability. This model forces an examination of vulnerability and it can illuminate risk in ways that the old ‘likelihood’ model can’t.
In Arizona, where the likelihood of rain is minimal, you might get away with using that model even though it’s incomplete. Yet even there, downpours do happen and vulnerability in the context of specific risks should be accounted for. The threat/vulnerability/magnitude/risk model takes this into account.
A mismatch between the above elements is where the risk meets the road. As we’ve seen, a low level of threat paired with high vulnerability is probably fairly safe. High threat with very low vulnerability is also a reasonable risk. But high threat paired with high vulnerability is a recipe for disaster. That is a mismatch and action must be taken to protect assets.
Submerged Risk / Submerged Value
When you arrive for the meeting, dry and looking good, your reputation – so at risk in the first instance – will not suffer, thus wiping out the submerged risk. In fact, as others see how well prepared you were for Seattle’s inclement weather, your reputation will be enhanced. This, of course, is submerged value, secondary and tertiary value from the actions you take that, like submerged risks, are buried under the surface, invisible until raised.
Omnipresent Risk
Rain, even in Seattle, is not a constant. It is often possible to walk to work unscathed, safe and dry. But what about when the threat never goes away?
Let’s place you in your brand-new Pacific Coast office. Your new laptop isn’t ready, so you pull out your own and hotspot your way to the internet. You are now at a 100% level of threat from malware, ransomware, security breaches, data loss and equipment damage.
How do the two models compare now? When the risk is constant it’s not even close.
Old Model:
Okay, but is that a realistic assessment? How many people in 2020 don’t have some sort of protection on their systems? This model, once again, does not specifically account for that. Under the new model, the risk looks like this:
And not only does vulnerability go down, so does magnitude – because the addition of virus protection and firewall also lowers the likely damage an infection would do if it did occur, in this case to $250.
Of course, the costs of reducing vulnerability and magnitude must be factored in as well, whether an umbrella and galoshes, or antivirus protection and cloud backup. The total now becomes:
This is not just a huge difference in total risk from the likelihood model, it’s also a far more accurate description of the way the world works. All organizations know the chance of an unprotected computer being compromised is 100%, and none just resign themselves to suffering the full magnitude of the damage.
Since every organization takes precautions