I spent a long weekend at the beach swimming, lying in the sun and building sand castles with my wife and daughter. The weather couldn’t have been better and a wonderful time was had by all.

My daughter is only four, so she isn’t entirely clear on things like tides, high water marks and Large Waves. She picked a point midway between the low and high tide lines and we built a very simply castle, more of a pile of sand than a proper sand castle. It took about five minutes.

Immediately, the waves began trying to wash it away. “Daddy! Do something!” she exclaimed. So I dug a trench in front of the castle and used the excavated sand to create a small berm between the trench and the castle. It stopped the erosion, but waves being waves and sand being sand, the fix was only temporary.

Nevertheless, I was having fun creating massive earthworks to protect what had become by comparison, a tiny castle. But after half-an-hour or so, a massive boat wake washed right past my berm, over my castle, beyond the high tide line, and stopped just short of my wife who was alternately napping and watching our efforts with some bemusement.

As proof that I didn’t take enough time off, my sand castle turned into a giant allegory for Risk and Network Security.

I had an asset whose value was Five Minutes. The asset owner, my daughter, was emotionally invested in the asset. I was having so much fun building countermeasures that I completely ignored the fact that I spent six times as much (30 minutes) to protect the asset as it had taken to build it. And, just to round it all out, a high-impact, low-likelihood event wiped out both my safeguard and my asset.

All in all, a perfect Tale of Risk in the Real World from a beautiful, sunny day at the beach.

Holy Cow!

It’s a blog!

A rather prolific one at that.

I had no idea.

Could not resist a reply.

Congrats on moving on up…I’m off to San Antonio for the week with my four year old to build my own sand castle, so to speak. Hope all is well.

B.