Although many people in the information security industry use the word "risk," few have a true understanding of its definition and how it relates to the business world.
The crux of risk management is that a company has an infinite amount of vulnerabilities, but finite amount of money available to deal with them. So the vulnerabilities that can cause the company the most harm must be dealt with first. Risk management is a science and an art that ensures that a company takes on only as much risk as it can handle and no more. This balance is much more difficult to achieve than most people are aware of.
|
