» Archive for January, 2006
Risk Management, Homeless Style
This is pretty messed up. According to This story, a couple of guys in Florida have been attacking the homeless with baseball bats. They’ve done it three times, killing the victim in one attack.
Before Thursday the homeless were invisible nomads, sleeping in our parks, under our bridges, on our city benches and in front of our public institutions.
We didn’t have to see them because we were too busy enjoying a good night’s rest, and knew they would be gone by morning.
Then we woke up and saw the shocking video tape of young males beating a homeless man mercilessly with bats in downtown Fort Lauderdale. Two other homeless men were savaged within hours of that attack. One of them, Norris Gaynor, 45, died. The identities of the two injured men were not released by police Thursday.
I don’t normally think of homeless people as Risk Managers, but they are. They may not have formal terminology or an awareness of it, but they definitely recognize the concepts of Vulnerability, Threats and Safeguards.
Vulnerability while asleep is a common problem for everyone. Most of us mitigate the risk by locking our doors at night. The homeless don’t have that option, so they adop different mitigation strategies.
Nearby a man who would only identify himself as Ken C. rested near his rusted bike on patch of grass. He said he never sleeps with his back to the streets. While some people try to sleep in the safer suburbs, he needs to be in downtown Fort Lauderdale for his daily activities. So he just takes his chances.
“You can’t get scared out here,” he said. “I’m a light sleeper anyway. I can hear people walking on concrete.”
Some sleep in areas like the suburbs where the likelihood of being attacked is lower. Some count on physical positioning or the ability to hear someone approaching. Managing the risks of homelessness is seems to a common topic of conversation among the homeless.
Compare that to my day-to-day. The only time I ever see this degree or level of honesty about risk in the business world is when I’m discussing SOX with the guy will wear the orange jumpsuit if he gets it wrong.
Posted in Security and Risk Management, Risk Management | No Comments »
Why I’ll always have a career
Due to some sort of glitch in either his RSS or my blog reader (Thunderbird), this very old post from David Cowan popped up as unread for me this morning.
I know I read it, but had forgotten about this excerpt:
As we approached the theater, I tried to think of how to explain the fluid nature of the data security threat. Walking in (thanks to Fandango we righteously bypassed the long lines of teenagers), I noticed that the theater had just implemented its own security program to mitigate Movie View Theft by patrons who would watch a second film without paying. Instead of collecting tickets at the front door, tickets were now collected at the two hallways off the lobby, to where customers were ushered out as each film ended. No ticket, no second movie.
So I said: watch this. I stood by the front door, waited for a lull in traffic, and then nonchalantly proferred my hand toward the next approaching bevy of teenagers. “Tickets” I murmured.
Once the first victim handed me his ticket, the rest were cake. Tickets accumulated in my hand as my victims jabbered on about football games and SAT prep. I collected half a dozen and stopped. A good 5 minutes passed before they wafted over to the hallway, encountering another ticket stand (by then I could have sold the tickets to folks standing in line). Another 2 minutes passed as they tried to figure out which of them had the tickets! As it dawned on them that they had been phished, I returned their assets (and thankfully they didn’t kick mine).
Security systems are not like computers or network switches, which improve over time and asymptotically approach perfection. To quote Justin Label, security is a Man v. Man problem, not Man v. Nature. Creative and motivated thieves respond to every new security system with a workaround, and so the best we can ever hope to do with the safety of our computer networks is tread water.
He was trying to make the point about why there are so many security start-ups, but I think it actually gains from being taken out of context.
People have ingrained expectations about how systems work. Beyond a certain level of familiarity, we utilize those systems subconsciously. When going to the movies, people expect to present their ticket at the door. When the theater removes that check, they don’t remove the expectation from the person’s subconscious brain and an opportunity for malicious activity is created.
As David notes, this is not a technology problem. But, ironically, this doesn’t keep people like himself from giving money to those who would try to solve it with technology. Of course, once people expect that technology to protect them, the next-weakest link in the chain of assumptions will be broken. And David will give money to others who would solve that next link with technology.
Which, might not be such a bad thing for him either, since it means that he will also always have a career.
Posted in Observations, Security and Risk Management, Risk Management | No Comments »
Hang up and Live
I heard something about this on NPR this morning, but it was pretty useless.
Adam Shostack, however, has a much more useful and link-o-rific post, “Mobile Phones, Modernity, and Stress”, which discusses a study examining the stress of being constantly available by cell phone and pager.
The round-the-clock availability that cell phones and pagers have brought to people’s lives may be taking a toll on family life, a new study suggests.
The study, which followed more than 1,300 adults over 2 years, found that those who consistently used a mobile phone or pager throughout the study period were more likely to report negative “spillover” between work and home life — and, in turn, less satisfaction with their family life.
The researcher’s suggestion?
To ease the extra burden on working mothers, she added, parents could have particular days when one or the other is “on call,” so that moms are not getting all of the appliance-disaster reports.
Great, I’m thinking, another on-call or coverage list I’ve got to be on.
I already have various on-call rotations that I somehow fit into–so many that I don’t even know what any of them are. Why security approvals need on-call, I will never know. Throw in that I’m usually covering for someone on something, the around-the-clock demands of working for a globalized conference, and it’s a wonder I ever leave work at all. Or maybe that’s why I’m so stressed these days. *sigh*
Now, if you’ll excuse me, it’s time for my after-hours call with Asia.
Posted in Office Life | 1 Comment »
Just Saying, “No.”
I grew up walking behind a Snapper mower back and forth across my yard every week for most of the year (mowing, like boating, is pretty much a year-round sport in Texas). Years later, I pushed that exact same Snapper across my own yard after years in storage and doing nothing more than changing the oil, air filter, and sparkplug. The only other thing I ever had to replace was the wheels, which I actually wore out. It lacked even the most rudimentary safety features, but it started every time, ran like a dream.
Maybe it’s just nostalgia for cursing my way back and forth across the yard, but I really liked this article on Snapper’s decision to no longer do business with Wal-Mart.
“As I look at the three years Snapper has been with you,” he told the vice president, “every year the price has come down. Every year the content of the product has gone up. We’re at a position where, first, it’s still priced where it doesn’t meet the needs of your clientele. For Wal-Mart, it’s still too high-priced. I think you’d agree with that.
“Now, at the price I’m selling to you today, I’m not making any money on it. And if we do what you want next year, I’ll lose money. I could do that and not go out of business. But we have this independent-dealer channel. And 80% of our business is over here with them. And I can’t put them at a competitive disadvantage. If I do that, I lose everything. So this just isn’t a compatible fit.”
…
No lightning bolt struck. Except that Snapper instantly gave up almost 20% of its business. “But when we told the dealers that they would no longer find Snapper in Wal-Mart, they were very pleased with that decision. And I think we got most of that business back by winning the hearts of the dealers.”
The President of Snapper had the courage to assess the situation, accept the risk that he might never going to get back that 20% of sales that Wal-Mart was currently contributing, and still say, “No,” to Wal-Mart. That is the difference between a leader and the average senior executive today. He looked at what was best for his workforce, his brand and, as a result, his company instead of chasing whatever he’s told will be best for the share price this quarter.
He took the risk that enough of the people buying lawnmowers both know the difference between high- and low-quality mowers and that they will act on that knowledge, one which is apparently paying off for the company as the independent retailers who sold the other 80% of their product are rewarding them for their decision
My sweat-stained hat is off to him for it.
Posted in General, Risk Management | 2 Comments »