Page 163 - CyberSecurityEssentialsEnglish
P. 163
about a type of task: summarizing is low impact for personal use, and may become high
impact if it is used on its own to determine rights or obligations.
TABLE 4-3: A MULTI-DIMENSIONAL RISK CHECK BEFORE USE
Dimension The practical question Its effect on the decision
The higher the probability, the
How likely is an error, an omission,
Probability more testing is needed before
or a misunderstanding?
reliance.
How large is the harm if the error High impact requires an expert,
Severity
occurs? an approval, or a prohibition.
How many people, records, or A small error spread widely may
Scope
decisions will be affected? become high risk.
Will we detect the error before it is If detection is hard, review must
Detectability
acted on? precede the action.
Irreversible actions need a
Reversibility Can the decision be undone easily?
stopping point.
Does the system propose, or does Every executive permission raises
Autonomy
it execute? the level of control required.
162
