Mixed Method Risk Analysis

Some people approach risk analysis from either qualitative or quantitative methodologies. However, both are needed for truly enlightened decision making. The term “Mixed Methods” is taken from social science research, and is particularly appropriate here. It is not enough to base risk analysis solely on the numbers, and it is not enough to merely gather opinions. Both need to be considered along with a reasonable assessment of the probabilities and an appreciation for the risk appetite. Not only for the risk event, but the follow-on events. The last point requires that we consider what the implications of the risk event are. This takes into account things like public opinion, staff morale, and market volatility.

Many people assume that risk analysis is merely a specialization of cost/benefit analysis. That view lends itself to a quantitative approach. How much is the asset worth? What will the down-time cost us? How often will the risk event happen? Punch these values into an equation, and *poof* a magic number. While there is value for such numbers when determining budgets, they miss out on very important details. Would your brand suffer if an event (say, a data breach) occurred? What would it cost you to repair that brand damage? How long would that take? How tightly are sales coupled with public opinion? Failure to ask such questions may lead to a risk mitigation strategy that, while defensible, may not be adequate.

Risk analysis should begin with a survey of key stakeholders to determine the perceived risks and what the impacts of those risks are (some include this in risk assessment).  Once a complete list is established, the list is then circulated again to determine the perceived likelihood of each, and the appetite for the expected impacts. The likelihood of certain risks, such as fire or theft, can be validated through enquiries made at local public records offices. The list of risks can then be sorted based on likelihood and appetite for potential impacts. Even if a risk is highly unlikely, it may be worth mitigation if the appetite for one or more of its impacts is null.

There are generally two approaches to budgeting for risk mitigation: Here’s your budget, do what you can; and Tell me what you need and we’ll discuss it. The first is somewhat easier as the initial boundaries are known. The later is more time consuming as it requires digging into the details for all identified risks and is often followed by “Oh, uhm, what can you do for ____ dollars?” In either case, it is the job (and responsibility) of the security professional to ensure that management knows which risks can be mitigated within the available budget, and which risks cannot be mitigated within the available budget. This is why Mixed Methods research is the correct approach to use in Risk Analysis.

Rotten Trade

One would have to be living pretty deeply under a rock to not know that Canada is being bullied by president #45 of the United States of America. President Trump has unilaterally declared economic war on Canada, and entered into bilateral discussions with Mexico in an attempt to subvert the North American Free Trade Agreement (NAFTA). That is, of course, his prerogative. It would seem that Free Trade, as a concept, is completely foreign to Mr. Trump, because he only views a "negotiation" to be a success if he "wins" and the other guy "loses". Free Trade, on the other hand is all about mutual benefit, not winners and losers. As such, I don't expect that NAFTA will have a life until the orange man is out of the white house. While the government of Canada continues to press for mutual respect in negotiations with Washington, we are restricting our tariff activities to "tit-for-tat" adjustments. This is the civilized approach, and our government is wise to do so. However, when dealing with a bullying ape guerilla tactics are in order. It is time for all Canadians to stand on guard for Canada and hit the United States of America where it will hurt most, the pocket book.

I sent a letter today to Prime Minister Trudeau requesting that the product labelling laws in Canada be adjusted to require the provenance of products be displayed, by percentage from each country, on all packaging. For example, if a box of cereal is imported from Mexico but uses wheat from the USA, I may want to consider another brand that uses wheat from Canada. Or in another case, just because a pair of shoes is assembled in Canada doesn't mean that they don't use uppers and soles from the USA. Perhaps the government could certify products that have more than a certain percentage of Canadian content (say 80% or higher).

Such changes however, if chosen, would take a long time to implement. We Canadians must act now. So I am asking that all Canadians contact the grocery chains at the corporate level, and advise them that we will NOT be buying produce from the USA, and request that they identify other sources of produce for their stores.

Grocery Landscape in Canada (click image to enlarge)

Almost all grocery stores in Canada are owned by one of three companies: either Empire Company Limited, Loblaw Companies Limited, or Metro. Writing to Loblaw Companies Limited one reaches 27 grocery and pharmacy chains. Writing to the Empire Company Limited, will reach 13 grocery chains. Writing to Metro will reach 5 grocery chains in Ontario and Quebec. To the best of my knowledge, there is nothing that is grown in the United States that cannot be either sourced from another country, or replaced with a comparable product from Canada. If the large grocery chains are made to understand that produce from the USA will just rot on their shelves, they will make other purchasing decisions, or they will lose sales to competitors who do.

The time to act is now. Stand up to this bully, and show him what Canadian grit and determination looks like. Call or write today. Don't know what to say? I've drafted some thoughts at the bottom of this page to get you started.

Loblaw Companies Limited

Customer Relations
Hours of Operation
Monday to Friday 8:30 am to 4:30 pm ET
Call toll-free: 1-888-495-5111
Email: customerservice@loblaws.ca

Empire Company Limited

Contact the Board of Directors
You may communicate with the Board of Directors through the Office of the Senior Vice President, General Counsel and Secretary in the following manner:

Doug Nathanson
Senior Vice President, General Counsel and Secretary
Empire Company Limited
115 King Street
Stellarton, Nova Scotia
B0K 1S0

E-mail: board@empireco.ca

Sobeys Customer Care
Atlantic
Call toll-free 1-888-944-0442
Monday to Friday 8:00 am to 5:00 pm (AST)
E-mail: customer.service@sobeys.com
Ontario
Call toll-free 1-888-821-5557
Monday to Friday 8:00 am to 4:30 pm (EST)
E-mail: customer.care.ontario@sobeys.com
West
Call toll-free 1-800-723-3929
Monday to Friday 8:00 am to 5:00 pm (MST)
E-mail: customer.helpline@sobeys.com

Metro

Call toll-free: 7-877-763-7374
or Fill out the web-form here.

Draft Email

Dear Sir or Madam,

I am a loyal customer of [name of chain].

I am very concerned about the situation involving Canada's trade with the United States. As such, I would like to advise you that, until an equitable NAFTA has been renegotiated that is fair to all trading partners, I will not be buying any produce that originates in the USA. I ask that you make sure that you source produce from other countries so that I continue to have the selection to which I am accustomed. If I cannot avoid American produce at your stores, I may have to avoid your stores to find stores that are willing to stand up for Canada.

Thank you in advance.

Stollen Cookies?

Have you heard that a frog can be cooked without a shock to its system by placing it in a pot with cold water, and gradually turning up the heat? Well, you are the frog, and internet-based mobile applications are the heat.

Last night, I was working on a blog post that had remained in draft mode for far too long, and part of what I did was to look for appropriate imagery using my phone. I started looking for "Tug of War" images on flickr.com before changing my search to "Sumo wrestling".

Today, Facebook magically showed me a "sponsored" post from NHK Japan for "GRAND SUMO LIVE". I have NEVER searched for sumo until last night, and that search was on the Flickr website.

The way cookies are supposed to work is that they are only accessible to the website that issued them. So, it would make sence for Flickr to keep track of my searches using cookies. But if I search for something on Google and then visit Amazon, Amazon shouldn't know anything about my activities on Google. Clearly, this is not the case with the Facebook Android app. My search history on Flickr should not be visible to any other site, and since I don't have a Flickr account, I don't think Flickr sold Facebook the data. Somehow, either through an astronomical coincidence, or some other means, Facebook managed to figure out that, at least right now, I have an interest in SUMO.

I'm not suggesting that you start making tinfoil hats. Nor have I deleted the Facebook App... yet. The point of this post, however, is that it truly is possible that this is just coincidence. However, Facebook's track record on matters of privacy is not that great. As a result, I am inclined to think that they are harvesting cookies from my phone. Do I have proof? No, but this is an example of what I have written extensively about: Ethical Debt. Because ethics do not seem to be high on the priority list for facebook, one tends to assume that every questionable event is somehow done in the shadows. Companies MUST hold themselves to a higher standard, because the consumer will stop granting credit if the ethical debt gets too high.

WR

CISSP Common Body of Knowledge - Domain One, a study aid

The Common Body of Knowledge (CBK) for the Certified Information Systems Security Professional (CISSP) is a lengthy document with a lot of terminology that may be new to those studying it. As part of my preparation for the exam, I started a list of keywords that jumped out at me. As that list expanded, it occurred to me that this would be an excellent basis for a series of crossword puzzles. To that end, here's the first one.

Note, this is by no means a definitive list of keywords. These are just some keywords that came to the fore as I studied. You might find others. I might create another crossword as I continue working through Domain One.

[pdf] [ANSWERS]

Across 4 An inspection that ensures that expectations and standards are met. 5 The stability of the state of something over a period of me. 6 To isolate dues so that they must be performed by more than one person. 7 Laws or by-laws enacted by governing bodies to control the activities of a subordinate group. 9 A violation of established law. 10 The assurance that the information accessed is correct and free from unauthorized modification. 12 The individual planning or perpetrating an event. 14 The foundational elements that guides one's thoughts and actions. 15 An uncertain event or condition that, if it occurs, has the potential to negatively impact the organization. 20 The assurance that only those individuals with appropriate permission can access information. 24 To ensure that the latest software is in use. 25 The means of ensuring that an activity is being performed with appropriate permission. 27 To observe what is taking place in real-me. 28 A firm belief in the reliability or truth of something. 29 In the case of Information Security, an unauthorized restriction placed on a system.

Down 1 A safeguard that protects against a specific threat. 2 The leadership and organizational structures and processes that ensure that the organization achieves its strategies and objectives. 3 A plan that demonstrates expected reaction to stimulus. 4 Something of value (to an organization in this case). 8 The means of ensuring that the source or destination of a communication is truthfully conveyed. 9 An unscheduled, and unexpected termination of a process or system. 11 To affect the application of core security principles. 13 An event or situation that, if it occurred, would prevent the organization from operating in its normal manner, if at all. 16 The assurance that systems and information required, can be accessed when needed. 17 The acronym that refers to the various stages of a system's existence. 18 A copy of information. 19 The opinion generally held by those external to an organization. 21 The importance given to different elements in a collection. 22 A system for gathering and maintaining information. 23 To improve the application of core security principles. 26 A negative action taken against an organization or system.

A step towards tighter airport security, or more invasion of privacy?

Researchers at the University of Manchester in collaboration with the Universidad Autónoma de Madrid, Spain have developed an artificial intelligence system that can be used to identify individuals based on the way they walk. The researchers envision usages in airport security and healthcare.

I applaud the researchers for  their work. After all, both security and healthcare are important areas that require continued advancement. Here's the question though: do you agree with their claims that since this is "non-invasive" it is not subject to the same privacy concerns as fingerprints or retinal scans?

Though the current technology requires the subject to walk on a specialised mat, people could be led across such a mat without their knowledge or consent to the scan. Furthermore, is it not conceivable that an evolution of this technology will be possible with multiple camera angles?

It seems to me that the protection of privacy is not only a question of the invasiveness of the scan, but rather the informed consent of the subject being scanned. Make no mistake, any system that can be used to uniquely identify an individual must be treated with the highest level of respect for the protection of privacy. This system is no different.

wr

Minimum Wage - Another Piece of Straw

I read "Restaurants 'taking from Peter to pay Paul' amid minimum wage hike" by CBC Marketplace and thought "here we go." I knew that the minimum wage hike was not going to have the desired effect, but I am quite disappointed that businesses are taking their hardship out on their employees. Once again, those who can least afford to pay, are going to shoulder the burden for everyone. Maybe this is the time to review wages across the board.

Now, I can hear the business owner's cry out "yes, but it's not our fault, the government saddled us with this burden, and s**t rolls downhill." I'm sorry, that is not acceptable. The actions shown in this Marketplace report, and those of certain Tim Horton's franchisees are unethical. Not only should you not be surprised when the public blames you, should should be ashamed for having tried it in the first place. I have written extensively on Ethical Debt in the past, check it out if you don't understand. The citizens of Ontario need to be made to see this for what it is, an increased tax on business. Like all tax increases, it will work its way through the entire supply chain, and end with the person purchasing the final item.

If business owners feel hard-done-by, why don't you take it out on Kathleen Wynne? When June 2018 rolls around, the populous of Ontario will vote, and the Wynne government will be unaffected (or even rewarded) for this tax because people will not see the long-term impact of her actions. Any rage that is generated, will be directed to businesses who are seen to be greedy by those with little or no knowledge of the true costs of entrepreneurship.

Instead, I suggest that you embrace this increase, and propagate it throughout your organisation... and quickly. Ask yourself, why do some people make more money than others? Does the person who makes more than minimum wage really add more value? If so, how much more? Then adjust her or his wage accordingly. If not, this becomes a training opportunity. This is an opportunity to begin paying people based on the value they provide, rather than the minimum that is required. It may seem trite, but if you care about your people, they will care about your business.

Obviously, these increases will have to be reflected in the prices of goods and services. After all, you are in business to earn a profit, not as a charity. However, I am not proposing that you have carte-blanche to gouge the consumer, but it is appropriate that your expenses are covered. And when the consumers are upset by the hit on their pocket-book, they will direct their anger to the person who initiated the hit, Kathleen Wynne. If you hold off, and try to survive, you will not only be putting your business at greater risk, but you will be letting the Wynne government get away with this attack on your livelihood.

We are all camels here. Each one carrying a burden for the values that our society holds dear. Let us be careful not to transfer our straw to our neighbouring camels, but rather refuse any additional straw that is placed on us just to win votes.

Fair Taxation?

CTV News reported on a town hall meeting in Kelowna, British Columbia, and the push back that Prime Minister Trudeau had to endure. It seems that some in the Liberal caucus, and the Prime Minister himself are a bit surprised that the country isn't jumping on this taxing small business bandwagon. Maybe it's because most people understand that the truly wealthy people of Canada will be unaffected by this change, and the people who are only "comfortable" will be hit, and in some cases hit hard.

You want a fair tax system? Get rid of income tax, and focus on a consumption tax like the GST. Don't single out the one segment of the population that is taking the biggest risk to create jobs. It is my opinion that if we'd raise the GST by somewhere around 5% to 7%, we could abolish income tax all together. Then, the government would be taxing the people with money, and not taxing the poor.

When the GST was introduced, there was a surplus. It seems obvious to me that this surplus was the result of the government basing its GST needs on the income tax ledgers. Once it was introduced, the government started taxing people who were otherwise not paying tax... or at least not all of the tax that the rest of us paid.

Of course, there could be no tax on children's clothing, food, books, cars under $10K or $15K, and a few other "essentials". But when someone goes out and buys a 60 inch TV? Damn straight they should be taxed. Someone buys a new car... absolutely? But someone buys school books or clothes? Not a chance. If you don't have money, you're not going to spend the little you have on the latest technologies and luxury items. But those people with money tend to replace these things at an alarming rate.

Fair taxation? Give me a break. The current tax rules in Canada are so complicated that only people with money, such as Mr. Trudeau, can take full advantage of all the loopholes. The rest of us file our income tax and HOPE we haven't left too much meat on the bone.