Risk Management has become the staple of IT security organizations. Adopted from financial and life insurance models Risk Management makes some unsupportable assumptions of predictability, and knowledge. The three tenets of Risk Management, discovery, ranking, and patching are all impossible to achieve. Therefore Risk Management thinking should be abandoned in favor of threat management.
Speaker Bio
Richard Stiennon