So now, we have defined policies, created a security architecture in line with the policy. Most security practitioners at this point will say, “we should have assessed risks first. Why do this after the policies are defined?” This is actually a very valid question. However, there are some advantages of doing this later.
Let us understand Risk first. The layman answer is risk is like a dare, and it is a catalyst for making a decision on whether the challenge/dare should be accepted or not. Everyone has a threshold, in risk terms this is called a Risk Appetite. We tend to take risks (or as we called earlier challenges) based on our understanding and perception of risk appetite. I use the words understanding and perception because risk is always subjective. We have all tried to make this scientific, objective, numbers driven; however, there are exceptions that are made when decisions are taken on basis of your gut and instinct. These are feel behaviours which are tough to justify and are more prone to belief in yourself than anything else. E.g. Instinct is what drives innovation and should we choose to ignore this, we will never get a new idea conceptualised and created. Hence some subjective behaviour patterns are expected during a risk exercise. 
This episode looks at the methods of assessing risk and giving you a structure which can be followed.

The flow described in this season can be used by in either of the below situations:

·       you and work standalone/ 

·       work with a consultant/expert 

·       can be used to run the show via the Arrka Privacy Management Platform (both for Security and Privacy). 

For details, reach out to us on [email protected]; [email protected]; twitter: sameeranja, twitter: arrka2; Give a reference of this cast and avail credits on the platform usage and subscription. The Arrka Platform is made by SMB and for the SMB.