Refocusing Security Around Risk And Applications

There are three common financial models used to determine security investment; the insurance model, the entitlements model and the risk model.  The insurance model weighs the costs associated with addressing a particular threat or vulnerability proactively against the cost and likelihood of it occurring. 

The problem with this model is it doesn’t consider opportunity cost, nor provide an holistic view of where investments are being made.  The entitlement model is a ‘status quo’ approach; where have we made investments in the past.  The problem with this model is that it assumes previous investments were appropriately focused and the world has not changed. The risk model – which focuses investment based on risk, is by far the most effective. 

In a risk model, operators or stakeholders must as a matter of urgency accommodate the fact that their investment level aligns with what they want.  A critical question to consider during decision making process and implementation based on best practices is, “Are there potential true investment in time and money to deliver on efforts that will have the most significant impact on reducing risk?”. This is ultimately the fiduciary duty of security personnel and therefore the best model for a critical infrastructure environment.

A lot of stakeholders on the continent more than ever before are talking about critical infrastructure (Cybersecurity and Physical Assets), yet it still remains a rather broader issue to African operators. As actors, investors, operators and managers, we have to address how to protect civil society and good governance even as we embrace the advantages offered by technology to accelerate Africa’s prosperity vehicle.