An introduction to thinking about risk

Jacob Kaplan-Moss opens a series on risk from his work in security and his outdoor hobbies, where he deals with questions about danger, benefit, and tradeoffs. He defines risk as the potential for both benefit and loss, then breaks it into likelihood and impact, with simple matrices as the usual way to compare scenarios.

Reading notes

#

• The author says that he spends much of his time thinking about risk, both in software security work and in outdoor activities.
• He notes that people who work with risk create more refined tools and mental frameworks, while people who do not live in that world usually find the conversation difficult.
• The text uses examples of flying, driving, and traveling to Alaska to show how risk judgment can be misleading.
• The series is presented as a quick introduction to the most important concepts for people who encounter risk only occasionally.
• The initial definition of risk comes from Deb Ajango: risk involves the possibility of gain and loss.
• The author applies this definition to trips in the wilderness and to releasing software before enough security review.
• Risk is then treated as something that every action aimed at a benefit carries along with the chance of loss.
• The text divides risk into two components, likelihood and impact, and uses the examples of a broken deployment and the theft of the CFO’s credentials to compare very different scenarios.
• It mentions that some areas add a third factor, exposure.
• The text says that it is possible to measure risk with numbers, including calculating an expected value, but that this is usually rare in practice and very labor-intensive.
• Instead, the author recommends categorizing risks into simple levels, as in 2x2 or 3x3 matrices.
• The 2x2 matrix appears as useful for distinguishing between choices such as crossing a river right away or looking for another option.
• In the context of information security, the 3x3 matrix is the most common form, and the OWASP Risk Rating Methodology is cited as a reference.
• The closing says that this framing helps discuss risk more clearly and sets the stage for the next part, on mitigation.