Geopolitical incidents pose new security risks with dire threats to U.S. corporations, Assante says. Instead of saying, 'You've got to have firewalls,' CIOs need to focus on the threatscape. To determine your company's risk profile, enlist the help of the COO, CFO, corporate legal counsel, auditors, bond raters and insurance companies. Mitigate Risk CIOs must know what risk their businesses are willing to bear. Take the risk of shoplifting, for example.
Grocery stores post sensors at exits and use surveillance cameras and store guards.
Jewelry stores keep gems under lock and key, and employees carefully watch as customers handle merchandise. Apparel stores put garment tags on clothing and sensors on the doors. Security in the networked world is no different, Schneier says. It's all about understanding what the risks are and accepting those risks, mitigating them technologically, procedurally or contractually. Schneier illustrates acceptable risk with a U-shaped curve.