What could go wrong? As an information security manager, I have often been asked that question. But, there are two ways it is asked.
The first is my preferred way. It is a genuine effort to identify and evaluate the risk associated with the item at hand. That is a conversation I want to have. That is a thought process I want to encourage.
Then, there is the other way. Instead of trying to identify risk, it is asked as if to imply that there is nothing that could possibly go wrong with whatever is being proposed, and only a fool would could think there would be.
Let's examine four use cases to see what could go wrong when asking the right questions. Read each one and stop to ask yourself what could go wrong before reading
Case 1 – The Ambitious Employee
Joe was an ambitious guy. He was an engineer for a leading HVAC manufacturing firm.
He wanted to improve his business skills so he enrolled to take some business classes from a local college. During class he was introduced to a new presentation manager called Prezi that seeks to go beyond PowerPoint. It operates on the desktop and in the cloud so you can access anywhere on any of type of device. Best yet, there is even a free version.
What could go wrong?
Joe was involved working on a building project for a major technology company who is well known for their secrecy. The building plans were very sensitive to the customer. Joe's team was providing the Heating, Ventilation, and Air Conditioning (HVAC) systems. Joe needed to do a presentation outlining their plans for the building. Wanting to do the best job possible, Joe decided to use Prezi and his new skills to develop his presentation. Joe did not consult with anyone before making this decision. This was unfortunate because Joe was using Prezi's free option that makes every presentation public. When the presentation was made, the customer immediately noticed this and realized that their sensitive building plans had been published in the public domain. I will leave it to you to imagine the damage to the relationship between Joe's employer and their customer.
Case 2 – The Weakest Link
A major technology firm provides one of the most widely used two-factor tokens in the world. Their security background and their recognition of the role their products play in their customers' security processes led them to employ a very sophisticated defense.
They are also a large firm with a significant need for high quality employees. To meet this need they work with a reputable recruiting firm to identify qualified candidates.