Risk tolerance: What is your risk appetite? --- To build up on reflections about increasing risks, and risk assessment mentioned by Ioni, Phannarith and Tracy, let me add a note related to - risk tolerance (and 'risk appetite').

Once we do risk assessment and get aware of threats and our weaknesses, we should also define our 'risk appetite' or the level of risk we can tolerate.

We will never be able to have 100% security - and we will inevitably remain vulnerable in some parts. This is not only a result of too complex environments and numerous (often invisible) vulnerabilities, but also of our limited resources: each institution can poor only certain amount of resources (people, money, time) into cybersecurity. A combination of risk assessment and risk appetite helps us prioritise our resources to defend what is critical to us.

One example is also the vendors themselves: they always prioritise critical vulnerabilities for patching; less critical vulnerabilities 'can wait'. One problem with this approach with vendors is that they don't have a full picture of how their products will be used - and if a vulnerability they assess as not critical may become critical in a different setting/use. Thus, the risk appetite of their customers vary.

Source author: Vladimir Radunovic vladar@diplomacy.edu