Understanding the relationship between the terms risk, threat and vulnerability is key to how we distinguish and then prioritize our security decisions. Throughout history, security professionals, mathematicians and political scientists have tried to come up with a formula, an algorithm or a model to measure these three terms and the relationship between them.
The magic model they sought was finding a decision making process for security priorities that would shelter them from being liable or accountable for the consequences of their decision. After all, if you can plug information into a model that generates an automatic “do” or “do not” decision, you can always blame the model if something goes wrong.
Today more than ever, millions if not billions of dollars are spent on research conducted towards finding such a decision-making scheme that will bear no political or personal accountability. Well … good luck. Any tribal leader, military commander or cartoon superhero will tell you (to quote Spiderman) “with great power comes great responsibility.”
In fact, the relationship between Risk, Threat and Vulnerability is not measurable. Why?
- The manifestation of threats is unlimited and yet very specific to each protected environment.
- Risk is truly measurable only for events that occurred in the past. Future events (threats that have not yet been tested in reality) cannot be quantified statistically.
- Vulnerability is difficult to measure because there is no real success matrix for security. One can not measure (quantify) good security as opposed to bad security.
Decision making regarding risk, threat and vulnerability is unavoidably challenging. But at the end of the day, risk is something you take, threat is something you face, and vulnerability is something you accept. What you do in between is try to mitigate, prevent and reduce. There are methods for doing this that are tested and true. Threat mitigation through Predictive Profiling is one way to enhance skills for making decisions in the field and in the executive office.
Quick question; if you can’t measure good security as opposed to bad security, is everyone blameless if a security failure occurs? …Also, nice, concise article.
Extremely stimulating approach that demands applying our mind in developing a RTV scorecard that enables the security pro to evaluate the scenario and on a 1 to 10 scale award a score to each category of RTV and then come up with the MPR operational plans that will neutrlize ones RTV environment.Busy to compile RTV scorecard example for further evaluation , adjustments, changes, etc to improve continually as circumstances dictate.
All comments welcome.
regards Andre
It is not necessary that security measured in numbers (quantifying), however, it an be placed on a scale of good and bad. very interesting article.
Regards,
Ahmed
If you really want to understand Homeland Security then attend Chameleons “Behind the Scenes” seminar in Israel.This is not a classroom based curriculum. The entire week is a hands on exposure to security and terrorist threats in a country that knows all too well about the subject and lives every moment with the threat. If you have the desire to understand the dynamics of the middle east and the necessary elements of security in the 21st century then you must attend this seminar. The day at Ben Gurion Airport is worth it’s weight in gold. When you walk away from the airport you realize that every airport in America is virtually without security. Israel has become the first and last word in security for one simple reason…,necessity. You could spend years reading and studying terrorism, security, and threat assessment and not accomplish an understanding that this one seminar offers and in my opinion delivers.