Wednesday in the Woods 022 - Risk as Rain: Interdependence of Incidents
Channel: Licensio, LLC
Date: 2022-02-23

Canoe believe that I took a little skate down to the banks of the Red Cedar?  That’s because we’re trading wetlands for wet land - specifically, flood plains - to help demonstrate what water can teach us about managing risk.

You’ve probably heard the phrase that “when it rains, it pours.”  And when this rain falls in the late winter or early spring here, it doesn’t just pour.  The rain falls on days when the air temperature is high enough to melt snow - the same kind of day when the ground heaves under thaw.  The kinetics of a hard rain cause the snow to melt even faster.  

Where the soil finally shows its face, mud quickly forms.  Skates and snowshoes may work well on ice and snow, but mud is a different story.

Then, the ice on the river breaks.  Big slabs, like tectonic plates, start to slowly flow and bump.  At bends in the river - or where the heave-ho of thaw has dropped a big tree into the river - the ice stops, jamming or damming up the flower.  Then, the real flooding starts.

When the real flooding starts, the roads become impassable - even for emergency responders.  Objects - even big ones, like cars - get carried away, deposited in mysterious or inconvenient places.

Then, the temperature drops overnight and it all turns into ice again.

So, what’s the lesson?  As insurers and reinsurers will tell you, risks are often much more interdependent or “correlated” than you wish.  Sometimes, the drivers of this correlation are geographic.  Instead, they might related to the industry you operate in.  Or, the correlation might be caused by certain open source libraries like log4j or IaaS providers like Amazon Web Services.

When you inventory your risks in a register, you probably list out probabilities.  But each one lives on a separate row, independent and isolated from the others.

Do you have a Teams outage listed separately from an Azure outage?  Is the threat of payroll service provider interruption correlated with the same ransomware wave that might hit your own devices?  

Some organizations model threats more holistically, using a graph, network, or correlation matrix as inspiration.  These methods can be helpful, especially as part of risk program reviews, but the real value isn’t in complex diagrams - it’s in being mindful of the risk of correlated risk.

So, yes, as the Ink Spots and Ella sang, into each life, some rain must fall.  We can’t avoid most risks, and we can’t even change the underlying drivers that create their correlation.  But, we can at least plan and prepare for these worlds.

Personally, I’d recommend a canoe or little fishing boat.  You won’t even notice the flood with a picnic basket or fish on the line.