It's all about understanding what the risks are and accepting those risks, mitigating them technologically, procedurally or contractually. Schneier illustrates acceptable risk with a U-shaped curve. On the left at the other top of the U are very expensive losses and no security. Where that sweet spot is will be different for every company, depending on their risk profile. Embrace Risk CIOs should approach security as risk management, rather than threat avoidance.
Some risk is good, say security experts.
Mass. Good risk management depends on a company's business model, its risks and the value of the transactions at risk, Schneier says. They still haven't solved the problem. That's the right way to think. To win the dollars you need for security, conduct a threat analysis based on your company's business model, Mudge says. Then build a business case for senior management, presenting security as a revenue generator, not an expense.