Risk Management: Or How Corporate IT Learned to Fear Everything Except the Things That Actually…
There is a wonderful phrase that gets tossed around in corporate IT meetings.
“We’re managing risk.”
It sounds responsible.
It sounds professional.
It sounds like someone has a giant dashboard filled with gauges, dials, and flashing lights that somehow quantify uncertainty into a neat PowerPoint slide.
In reality, it often means_,_ we’re going to spend six months arguing about the color of the lock on the front door while the back wall is missing.
Welcome to modern information security.
From the Headlines
The $40 Certificate That Protected a $400 Million Business
A major online retailer had a TLS certificate due to expire on a Saturday.
Renewing it would cost approximately $40.
Installing it required a five-minute maintenance window.
Unfortunately, production changes were frozen for the holiday shopping season.
Nobody wanted to violate the change freeze.
Several meetings were held discussing whether the certificate replacement constituted a “material infrastructure modification.”
The answer was inconclusive.
So they waited.
Saturday arrived.
The certificate expired.
Every browser displayed a bright red warning telling customers the website might be compromised.
Sales stopped instantly.
The outage lasted nearly eight hours while emergency approvals were obtained to perform the five-minute certificate replacement that nobody was allowed to do proactively.
The company lost millions of dollars in revenue.
Governance had successfully prevented a planned five-minute outage by replacing it with an unplanned eight-hour one.
The Firewall Rule Nobody Owned
Years earlier, a firewall engineer created a rule permitting unrestricted communication between two network segments.
The justification read:
“Temporary. Needed for migration.”
Nobody ever removed it.
Over the next decade:
- The application was replaced.
- The servers were decommissioned.
- The network was redesigned.
- The original engineer retired.
The firewall rule remained.
Eventually an attacker compromised a workstation in one segment and discovered they could freely move into an environment containing regulated financial systems.
The intrusion investigation concluded the attack itself wasn’t particularly sophisticated.
The attacker simply walked through a door everyone assumed someone else had locked years earlier.
The risk had been accepted…
…by people who no longer worked there…
…for a project that no longer existed.
The Backup That Was Too Expensive to Test
An organization proudly reported that backups complete successfully every night.
Green dashboard.
Green reports.
Green executive scorecards.
Everything looked wonderful.
Someone suggested performing a disaster recovery exercise.
The proposal was rejected.
Testing restores would require engineers to spend an entire day validating the process.
That seemed expensive.
Several years later ransomware encrypted nearly every production server.
The team confidently began restoring from backup.
That’s when they discovered the backup software had been faithfully backing up corrupted data for almost eighteen months.
Nobody had ever restored a complete system.
The nightly job had never failed.
It simply hadn’t been producing usable backups.
The organization had optimized for the appearance of resilience rather than resilience itself.
The engineers had saved one day of testing.
The company spent three weeks rebuilding its infrastructure from scratch.
The Goal
The common thread in all three stories isn’t poor technology — it’s poor governance. In each case, decision-makers focused on minimizing immediate inconvenience or preserving process compliance while ignoring the vastly larger downside risk. Good governance isn’t about saying “no” to every change; it’s about recognizing when a tiny, controlled cost today prevents a catastrophic, uncontrolled cost tomorrow. That’s the difference between managing risk and merely documenting it.
The Goal Isn’t Zero Risk
Let’s get one thing straight.
Zero risk does not exist.
If your organization’s goal is to eliminate all risk, congratulations — you’ve just invented the business model known as “turning off every computer.”
Unfortunately, this has an unfortunate side effect.
The business also stops functioning.
Risk management has never been about eliminating risk.
It’s about making informed decisions regarding which risks are worth accepting.
Notice I said informed_._
We’ll come back to that.
Risk Registers
Every respectable corporation has one.
Usually several.
The Risk Register.
It’s a magical spreadsheet where problems go to become immortal.
Rows are lovingly populated with:
- Risk ID
- Description
- Probability
- Impact
- Mitigation
- Owner
- Status
Somewhere around row 847, you’ll find gems like:
“Potential exposure resulting from unauthorized misuse of externally facing legacy middleware.”
Translation:
“Bob hasn’t rebooted that server since 2012.”
The Sacred Risk Matrix
No discussion of governance is complete without the famous 5×5 matrix.
You know the one.
Impact Low Medium HighLowMedHighLikelihoodSomehow every conceivable catastrophe can be reduced to one of twenty-five little squares.
Meteor strike?
Medium probability.
CEO accidentally deletes production?
Low probability.
Intern running DROP DATABASE in production?
Historically…medium.
Numbers Because Numbers Look Scientific
Security loves numbers.
Not because they’re accurate.
Because they’re comforting.
“This vulnerability has a CVSS score of 8.7.”
Excellent.
How many dollars does that cost?
“…”
How likely is it to happen?
“…”
Can anyone actually exploit it?
“…”
But it’s definitely an 8.7.
And that’s important.
Compliance Is Not Security
This deserves repeating.
Compliance is not security.
Passing an audit means you successfully convinced an auditor that your documentation matches reality closely enough that nobody asked difficult questions.
It does not mean your environment is secure.
Many organizations have successfully passed audits shortly before becoming headline news.
The attackers, it turns out, rarely request copies of your compliance certificates before breaking in.
The Meeting
Every organization eventually holds this meeting.
Someone presents a genuine technical concern.
Perhaps:
“We’re running unsupported operating systems.”
Or:
“We have no disaster recovery testing.”
Or:
“Our backups have never actually been restored.”
Silence.
Then someone asks:
“What’s the business impact?”
The engineer explains.
More silence.
Finally someone asks:
“Can we accept the risk?”
Translation:
“Can we make this someone else’s problem?”
Meanwhile…
Back in engineering…
Someone is trying to build a service capable of handling thousands of requests per second.
The database team wants additional storage.
The network team wants another firewall.
Security wants another approval workflow.
Legal wants another disclaimer.
Architecture wants another review board.
Governance wants another committee.
Eventually there are seventeen approvals required before changing a DNS record.
The attackers, meanwhile…
…are working remarkably committee-free.
The Beautiful Art of Accepting Risk
One of my favorite governance outcomes is the formal Risk Acceptance.
It’s wonderfully honest.
A document that says:
“We know this is dangerous.”
“We know the recommendation.”
“We’ve decided not to do it.”
Sometimes that’s absolutely the correct decision.
Not every vulnerability deserves immediate attention.
Not every outdated library requires an emergency weekend maintenance window.
The problem isn’t accepting risk.
The problem is pretending you aren’t.
The Security Theater Department
Corporate IT occasionally drifts into performance art.
Password expiration every thirty days.
Quarterly security awareness videos starring painfully enthusiastic actors.
Annual phishing tests that reward employees with public humiliation.
Twelve mandatory approvals to open port 443.
Meanwhile…
The production administrator password is still:
Summer2017!Because changing it would break twelve applications that nobody understands anymore.
Measuring Everything Except Risk
Organizations love metrics.
Number of vulnerabilities.
Number of phishing emails.
Patch compliance.
Mean time to acknowledge.
Mean time to assign.
Mean time to discuss scheduling another meeting.
Somehow the dashboards become increasingly colorful while answering fewer actual questions.
The most dangerous metric is often the one that isn’t measured.
How resilient are we?
Nobody knows.
Can we restore after ransomware?
Probably?
Have we tried?
…
Next question.
Governance
Good governance is invisible.
Bad governance is everywhere.
Good governance helps engineers make better decisions.
Bad governance helps committees schedule additional meetings.
One empowers.
The other generates Visio diagrams.
The Most Dangerous Phrase in IT
If I had to nominate one phrase that has preceded more outages than any other, it would be:
“We’ve always done it this way.”
Closely followed by:
“Nobody knows why that’s configured like that.”
And finally:
“Don’t touch that.”
Whenever someone says “don’t touch that,” you have discovered either:
- The most important server in the company.
- The least understood server in the company.
Occasionally both.
What Good Risk Management Actually Looks Like
Believe it or not, good risk management isn’t exciting.
It looks remarkably boring.
You understand your assets.
You understand your threats.
You understand your business priorities.
You spend money where it meaningfully reduces risk.
You consciously accept the risks that remain.
You revisit those decisions as circumstances change.
Most importantly…
You don’t confuse paperwork with progress.
Summary
Information security isn’t about preventing bad things from happening.
That’s impossible.
Risk management isn’t about eliminating uncertainty.
That’s impossible too.
It’s about making deliberate, informed trade-offs between security, cost, usability, and business objectives.
If your governance process requires seven committees, three steering groups, two executive reviews, and a forty-seven page spreadsheet to decide whether a server should receive a critical security patch…
…you may have accidentally optimized for governance instead of security.
The attackers appreciate your dedication to process.
They’re already inside.
They just haven’t been invited to the next risk review meeting.
Notes
- AI / GenAI / ChatGPT / etc were not used to generate the text of this article.
- ChatGPT was used to generate the images.
- I used em dashes in my writing before the current GenAI wave was a thing. Not planning on changing now.
- Names have been changed to protect the guilty.
- None of the hostnames or users used in examples actually exist.
- Feel free to post any comments or suggestions below.
Originally published on Medium.