Comments on: Risk acceptance – does it really matter?

By: Ben

Ben — Fri, 11 Dec 2009 20:16:56 +0000

I was in a meeting a couple days ago when the “person in charge” uttered that “ok, we'll just accept that risk” phrase… I immediately thought of your post here since no real assessment had been done to fully quantify the “risk”…

By: Gracie

Gracie — Thu, 10 Dec 2009 18:14:06 +0000

Oh, ok. Thanks Wade!

By: wadew

wadew — Thu, 10 Dec 2009 17:29:43 +0000

I wasn't really considering low risk vulnerabilities. Theoretically, if the vulnerability can lead to a serious hack, it wouldn't be through a low risk issue.

By: Gracie

Gracie — Thu, 10 Dec 2009 17:22:19 +0000

but what if you know the risk is Low and feel like you are giving a valuable response as a security officer that you recommend they accept the risk?

By: wadew

wadew — Wed, 09 Dec 2009 18:53:30 +0000

I assumed that the risk accepted by the executive/official was as a result of a finding from an assessment. As in, “yes, we acknowledge that there's a security hole, but we're willing to accept the risk”.

By: CG

CG — Wed, 09 Dec 2009 18:46:35 +0000

nothing happens when they get owned if they are blatantly at fault, why would something happen if they actually did a risk assessment…