Threat Management

Life is a dangerous business, and civilisation has struggled to achieve success in a predatory jungle abounding with threats. We have all always managed threats throughout history. Fear is one way of managing; using the mind is often a better way. While threats will never disappear, evolution has given an edge to those who are willing to use their intellect, a greater probability of winning than the predators.

Predators have learned to scour the Internet. They are driven not by idle curiosity, but as always by hunger, greed or a desire for power. These prehistoric incentives will continue to spur these modern-day bandits on to greater resourcefulness in their attacks. The reward is enticing, as an increasing portion of our global economy is already irreversibly network- and IT-based. For those of us who want to ensure that civilisation keeps winning, this means we will need to use our mind even more effectively to keep the criminals at bay.

The race will continue. Viruses and computer hacking in different forms have been constantly evolving for about two decades now. F-Secure and other companies in the information security industry have been coming up with successful ways of managing this threat. Managing the known threats is actually fairly easy, in retrospect. But the key question is how to manage the next threat, something new that no crook has done before.

From our customers’ perspective, threat management is a balance between the cost and effort of managing IT threats, and the risk and impact of potential incidents. This was illustrated by keynote speaker Martin Smith at a recent Gartner conference using a simple formula:

RISK = THREAT x VULNERABILITY x IMPACT

Threat here refers to how widespread the threat is. Vulnerability refers to your particular vulnerability, i.e. whether you use technologies that are vulnerable to the specific threat type. And finally, impact refers to how seriously an incident of the threat would impact your business or life, in terms of cost or other effects. From a threat management standpoint, this means a couple of things. Firstly, if any of the three factors is close to zero, there is no need to put much effort into protecting against that threat. It also means that if the impact is very serious you should ensure to protect yourself against that threat even if the other factors are not that high.

My recommendation is to begin your analysis by looking at the impact of potential virus attacks and data intrusions from the perspective of your core activities, whether business or personal. In other words, how much would you lose if a data threat affects your systems? You can then look at ways of reducing the vulnerability, either through selected technology or protective solutions and services. The threats are out there unfortunately, and there is not much you can do about that. It is still a jungle, but if we use our heads we can help civilisation to win out.

Pär Andler, Marketing Director, Global Marketing

Begin | Back