Risk Management

Risk management: An inside view

CIA logo

This text is intended to be a caption for the above image.

In a practical as opposed to a theoretical sense, there are pros and cons to the current focus on risk management, said Robert Bigman, who retired as the CIA’s chief information security officer earlier this year and is now CEO of his own consulting firm, 2BSecure LLC.

“I think it has a lot of appeal in government for agencies getting a handle on what they have, though not necessarily where the risk is,” he said. “Most agency CIOs don’t know what they have and what’s connected to what, so in that sense the risk management process is good, not just from an asset management perspective but also for security.”


Main story: Cyber insecurity: Managing against the risks


However, there is no accepted common concept behind what risk management means in the IT environment, Bigman added. Management strategies are good when you have a finite set of variables and know what you are dealing with, but that’s not typical for IT security.

Furthermore, most agencies must take risks every day in order to do their jobs — risks that a risk management strategy will tell you not to take. In that case, he said, what is likely to take precedence?

“Because of the event-by-event, case-by-case state agencies are in, security is a day-by-day, tactical response program, and what we’re doing is running around putting out fires and trying to keep the mission going,” he said. “This notion that you can automate this and interactively understand your risk on a daily basis is a whim, a farce.”

About the Author

Brian Robinson is a freelance writer based in Portland, Ore.

Featured

  • Cybersecurity
    Shutterstock photo id 669226093 By Gorodenkoff

    The disinformation game

    The federal government is poised to bring new tools and strategies to bear in the fight against foreign-backed online disinformation campaigns, but how and when they choose to act could have ramifications on the U.S. political ecosystem.

  • FCW PERSPECTIVES
    sensor network (agsandrew/Shutterstock.com)

    Are agencies really ready for EIS?

    The telecom contract has the potential to reinvent IT infrastructure, but finding the bandwidth to take full advantage could prove difficult.

  • People
    Dave Powner, GAO

    Dave Powner audits the state of federal IT

    The GAO director of information technology issues is leaving government after 16 years. On his way out the door, Dave Powner details how far govtech has come in the past two decades and flags the most critical issues he sees facing federal IT leaders.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.