Case Study

Harland Clarke Rechecks Risk Management

New security program adds more systematic processes for evaluating, prioritizing and mitigating risk

By Mary Brandel

"The chances were fairly high that even a low-level worm or virus would shut those systems down," Petrie says. "We determined that it was not an acceptable risk to not apply this patch," especially because it could be applied during maintenance windows rather than bringing systems down.

"The whole process was a complete review of the decision we'd already made several months earlier," Petrie says. "That's why a risk management program is so critical—the threat had changed, so we had to reassess our decision and make a new one based on that."

And that, he says, is indicative of what the security manager's job is all about. "The passage of time is critical," he says. "Risk management is not a stagnant process but a continuous one."

Other stories by Mary Brandel

• Email
• Print
• Comments
• Digg This
• SlashDot

• WS Meltdown Could Spur Risk Management Spending
• Information Security Management: The Basics
• Understanding Risk, Post-Katrina
• A Few Good Information Security Metrics