So just what is this thing called security risk management (SRM)
The Security Risk Management Body of Knowledge defines security risk management as the culture, processes and structures that are directed towards maximising benefits and minimising adverse effects associated with the intentional and unwarranted actions of others against organisational assets.
While technically true, this definition still does not tell us what that means to the average person. In his article, ‘The Psychology of Security’ , Bruce Schneier observes that Security is both a feeling and a reality. And they’re not the same. Getting closer to the truth of the matter now – or at least to a useful definition.
Security is arguably the form of risk management with which we as humans should in theory have the most experience. Well before the ISO31000 Risk Management Standard or even concepts of occupational health and safety risk management, financial risk management, health risk management, and so on, our cave dwelling ancestors had to learn to manage life and death risks from predators, rivals and other clans.
After a million years of evolution we are now the proud possessors of a finely tuned reptilian brain which can generate fight or flight decisions in an instant. Ideal for facing (or fleeing) the sabre-tooth tiger, evaluating the threat of strangers walking into your encampment and a host of immediate ‘in your face’ risks, the amygdala has served us well.
