Risk Management

Risk management: An inside view

CIA logo

This text is intended to be a caption for the above image.

In a practical as opposed to a theoretical sense, there are pros and cons to the current focus on risk management, said Robert Bigman, who retired as the CIA’s chief information security officer earlier this year and is now CEO of his own consulting firm, 2BSecure LLC.

“I think it has a lot of appeal in government for agencies getting a handle on what they have, though not necessarily where the risk is,” he said. “Most agency CIOs don’t know what they have and what’s connected to what, so in that sense the risk management process is good, not just from an asset management perspective but also for security.”


Main story: Cyber insecurity: Managing against the risks


However, there is no accepted common concept behind what risk management means in the IT environment, Bigman added. Management strategies are good when you have a finite set of variables and know what you are dealing with, but that’s not typical for IT security.

Furthermore, most agencies must take risks every day in order to do their jobs — risks that a risk management strategy will tell you not to take. In that case, he said, what is likely to take precedence?

“Because of the event-by-event, case-by-case state agencies are in, security is a day-by-day, tactical response program, and what we’re doing is running around putting out fires and trying to keep the mission going,” he said. “This notion that you can automate this and interactively understand your risk on a daily basis is a whim, a farce.”

About the Author

Brian Robinson is a freelance writer based in Portland, Ore.

Featured

  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.