ICYMI: Risk Management and the Paradox of Common Sense

I really enjoy reading Duncan Watts work and I was blown away by how he assailed the concept of common sense that we all rely upon so readily:

What we don’t realize, however, is that common sense often works just like mythology. By providing ready explanations for whatever particular circumstances the world throws at us, common sense explanations give us the confidence to navigate from day to day and relieve us of the burden of worrying about whether what we think we know is really true, or is just something we happen to believe.

Questioning our perception of reality is pretty heavy and you can spend a lot of time working through that. But in my article I use this idea to break out of the crutch of using common sense to manage risk.

You can read the full article on the @ISACA Newsletter site here.

 

ISACA Global Achievement Award Winner

I’m very pleased to announce that I have been awarded an ISACA Global Achievement Award, specifically the John W. Lainhart IV Common Body of Knowledge Award. Full citation below:

ISACA John W. Lainhart IV Common Body of Knowledge Award
Scope: Recognizes an individual for major contributions to the development and enhancement of the common body of knowledge used by the ISACA community.

Jack Freund, Ph.D., CISA, CISM, CRISC
“For contributions in developing the CRISC Certification and for ensuring the integrity and quality of the CRISC Certification exam content.”

I’ll be granted this award on 28 May at the ISACA EuroCACS conference in Edinburgh, Scotland.

The full list of this year’s award winners is here.

I’m very proud of the time I’ve spent working on the CRISC certification (almost 8 years now) and it’s astronomical growth since its launch. I truly do believe that it is a very high quality IT risk certification that employers can rely on to ensure that their staff has core IT risk knowledge. I’m very humbled to have my small contributions acknowledged in this way.

 

Lowest Common Risk Denominator

I tackle the notion of risk appetite in this month’s column using some metaphors with which you might be familiar. You don’t get to pick your auto insurance coverage by expressing the number of accidents you are willing to accept, yet that’s how a lot of organizations think about cyber risk. Fortunately, the cyber insurance industry is going to force us all into thinking about risk in dollars, the same as everyone else, because that is the lowest common risk denominator.

You can read more here.

Risk and Regulation

My latest @ISACA article was published today. In it, I focus on the notion of where our authority comes from in Information Security. Too often, in my opinion, we rely on regulation as a source of “why” when articulating control requirements. I think this is dangerous and counter to the very nature of what an effective risk practitioner is.

Take a read and let me know your thoughts!