RSA, COVID-19 and Risk

As I write this, two issues are taking place concurrently: The RSA Safety Convention is in full swing and so is COVID-19 (coronavirus). It’s an odd juxtaposition. There may be geographic proximity in that the convention is happening undeterred just some blocks from the place the mayor declared a state of emergency (in the course of the occasion) because of the ongoing unfold of the virus.

There’s additionally topical alignment because the RSA Convention, itself a pillar in an business intimately involved with threat administration, makes starkly clear the danger administration selections made by the attendees on the occasion (in addition to notable non-attendees like IBM, AT&T and Verizon.) Briefly, it’s an fascinating cut up display screen second.

At first blush, it might appear morbid — or akin to worry mongering — to debate these two issues concurrently. Nonetheless, I feel unpacking and inspecting it has sensible worth for safety practitioners, particularly for these involved with the broader matter of threat.

Particularly, it supplies us with a uncommon window into the danger administration selections of each massive and small corporations, and it’s a reminder for safety and threat practitioners about foundational however typically neglected parts of safety planning.

Contemplating each of those elements will help us hone our threat administration efforts and enhance our total safety posture.

Assessing Your Threat Urge for food

Let’s begin with the primary one: what we are able to be taught concerning the threat administration calculations made by the corporations that determined to attend (or cross up) the RSA Convention this yr, particularly close to what it says about their threat urge for food and ours.

It’s past apparent to say that the choice to withdraw from the occasion couldn’t have been simple for the organizations that did so. IBM, for instance, is likely one of the bigger gamers within the safety merchandise house: For the eleventh straight yr Gartner named IBM’s QRadar within the leaders section of its SIEM magic quadrant; IBM was slotted to be a platinum sponsor of the occasion (the second-highest sponsorship tier); and IBM owns subsidiaries which might be related to the safety neighborhood (notably Crimson Hat.)

Whereas solely IBM itself is aware of for certain the complete enterprise affect of its determination to withdraw from RSA, its calculation will need to have factored in important direct and oblique monetary loss. There may be not solely the direct lack of investments already made and assets already dedicated (e.g. prices incurred for printed supplies, worker journey, delivery of supplies, and worker time spent planning for the occasion), but additionally alternative value within the type of enterprise not performed, offers not closed, and buyer interactions missed.

Given the truth that, on the time the choice was made, solely a handful of COVID-19 infections had been confirmed within the U.S., this tells us one thing important concerning the threat administration calculations these corporations made.

Notice that I’m not suggesting they had been proper or improper in making the selections they did. The identical selections might have been proper for them however improper for one more agency. That is what makes it so fascinating from a pure threat administration perspective.

Specifically, it’s fascinating as a result of many organizations don’t cease to contemplate their very own threat urge for food, both holistically or systematically. This leaves them scrambling when the time involves make a tough name like this one. On one hand, there’s the direct monetary value and the lengthy tail of the chance value; on the opposite, there are the potential legal responsibility ramifications if a number of staff develop into contaminated.

The purpose? Whether or not you’re a big, multinational agency using a formalized threat administration course of or whether or not you’re a small startup figuring it out as you go, a radical and workmanlike evaluation round your individual threat urge for food is time effectively spent.

Cultivating the Preparedness Behavior

The second space the place I feel we are able to be taught is across the thought of ongoing preparedness. This one could be self-evident, however a second like this may function a reminder and a name to motion if preparedness documentation has sat on the shelf gathering mud for fairly a while.

Particularly, it’s doable that we’re on the cusp of main disruption to enterprise as common. Relying on whom you ask, “doable” falls wherever on a spectrum of very distant to an nearly certainty — however it’s inarguable to say {that a} pandemic may come to cross over a reasonably brief planning horizon.

Preplanning and preparation can imply the distinction between calm, rational decision-making and last-minute scrambling or, worse but, making an attempt to wing it within the face of some disaster. Subsequently, now could be time to take inventory of what precisely your plan is that if there’s a large-scale outage or disruption to enterprise.

This true whether or not or not you personally consider it’s more likely to come to cross. If it seems that you’ve got invested a while pondering by a situation that doesn’t happen, you’ll be higher off for the long run.

This is applicable to enterprise continuity planning usually, in addition to pandemic planning particularly. It may possibly embody continuity concerns within the summary: addressing questions like, “How will staff carry out their duties if they can not get to a bodily location?”

It can also tackle extra particular questions like, “What are the legal responsibility implications of requiring staff to come back to a facility the place they might develop into sick?”

Both means, by pondering this stuff by forward of time we’ll be prepared if we must always we discover ourselves within the worst-case timeline.

Notice right here that I’m not suggesting each agency wants a pandemic plan. I’m additionally not suggesting that you just drop every little thing and attempt to cram in a significant BCP train proper now. Anybody who’s completed one is aware of {that a} soup-to-nuts train takes months, and making an attempt to conduct one in a scientific, adrenalin-free means earlier than COVID-19 resolves, someway, probably isn’t doable.

As a substitute, my broader message is twofold: 1) Any planning is sweet planning; and a pair of) What’s occurring within the headlines is an efficient reminder why.