The way that I look at the risk is that I always use the web
risk with opportunities. Welcome everyone to the Industrial Security Podcast. My name is
Nate Nelson. I'm here with Andrew Ginter, the vice president of Industrial Security
at Waterfall Security Solutions, who's going to introduce the subjecting guest of our show
today. Andrew, how's it going. I'm very well, Thank you,
Nate. Our guest today is doctor Johonnica Ruwanpura. He is a professor at
the University of Calgary. He is the Vice provost of the entire university,
you know, an associated VP of Research, and you know, he's a
professor of engineering and project management. And Johnica does a lot of work with
risk, very generally, and so we're going to explore today how cyber risk
fits into the big picture of risk, you know, inside of engineering and
construction and other kinds of projects and organizations. Then, without further ado,
let's get into the interview. Hello, Chanaka, and welcome to the podcast.
Before we get started, can I ask you to say a few words
about yourself and about the good work that you're doing at the University of Calgary.
Thank you, Andrew. My name is Janaka Ruanpura. I'm currently the
Vice Provost International and Associate Vice Personnel Research at the University of Calgary. At
the same time, I'm also a professor in the Shulike School of Engineering,
specializing in project management. If I were to give about my connectivity with the
university, of course, I look after the global engagement of the University of
Calgary, which includes every aspect of it in terms of academic, research,
mobility and industry connections. In terms of the University of Calgary, I think,
you know, we are very proud that being a young university and particularly
last year we became truly number five in Canada as a top five research university.
At the same time, I think the other key element that I want
to talk about and might be very interested to hear for your audience is that
for two consecutive years, the University of Calgary is the number one startup companies
produced, which is actually a tremendous recognition and reputation for a university like us.
Whereas when you look at even the top five, the remaining four in
terms of the scalability and the size are much bigger, and then also they
are older more than a hundred years old. Cool. I mean, I
am an alumnus of the University of Calgary. I'm I'm a great fan of
the university. But our topic today, our topic today is risk. I
mean, you are an expert in risk in the context of sort of engineering
project management. You know, we're, of course on the podcast interested in
cyber risk, but cyber risk fits into sort of a bigger a bigger picture
of sort of overall risk management. You've got the risk of I don't know,
hurricanes and fires and who knows what. So um, you know you're
an expert on risk. Can you start us at the top? You know,
what is risk? What's the big picture of risk? What are we
worried about? What should we be worried about? Yeah, I mean,
Andrew, the key element of the way that I look at the risk is
that I always use the word risk with opportunities and my expertise is mainly in
the project risk management side of things. And yeah, I think the key
is that we look at every possible thing for a project, that what are
those elements challenges, that uncertainties that could create challenging and problems in moving ahead
with our projects. So I think that's where we look at and say how
we convert some of those negative things, such as the negative risks into a
better opportunities where we will handle them. We identify them up front, we
come up with we come up with good solutions to deal with them so that
we can run projects with minimum impact of risks and uncertainty, so that the
projects will be successfully planned, designed and implemented. And I think that would
apply even in newer domain in the cybersecurity area, about how we identify these
risks in advance, and then how do we come up with a sustainable,
practical solution that would benefit the key stakeholders and to ensure success at the end
and say we have done a good job. So that makes sense at a
high level. But I thought I heard you say that if you look at
them hard, sometimes risks turn into opportunities. Can you give me an example.
How how does that work? Yeah, Andrew like coming when I dealt
with a few risk analysis sessions with industry folks, and I can tell you
that in one occasion that we were doing a project in Fort McMurray and then
we went through the complete risk analysis process which I'm going to explain to you
later. Ben, we identified few risks and then when we look at the
impact of the risks to the project schedule, we realized that we could not
maintain the time challenge in terms of, you know, the number of weeks
or the months to complete the project. And at that moment we felt that,
I think we need to look at some alternate designs so that you could
cut down the time duration of the project. So the team was very committed.
They look at some alternate designs and as a result of that, then
then we did the same thing. We look at them and we simulated to
find out what's a new project duration, and then we realized, yep,
we could achieve the time duration right. And similarly, I can think of
another example that which I can even speak about it, you know openly the
Olympic oval restoration that happened about twelve years ago at the University of Calgary.
And when we look at the risks, we had a big challenge in twenty
eleventh September because the facility was already committed for other clients for practicing. As
you know that this is the place that we call the fastest size, and
when we look at each of the risks, we were very very determined the
project was so committed, and they came up with some creative solutions to reduce
the time duration of the project. Right. That's why I'm saying it.
So sometimes you look at the risk in a negative way, but if you're
committed to come up with a better solution to deal with the risk, it
creates an opportunity to come up with a better design, maybe more efficient design,
maybe a more sustainable design, right, and maybe a more creative design
that helped the project team to achieve the outcomes of the project in terms of
reducing the duration, reducing the cost, maybe enhancing the efficiency and things like
that. So that's what I meant by don't always look at the negative side
of the risks, look at how the risks can create additional opportunity. It
is so Nate Janaka was saying there, um, you know, he gave
an example of of h you know, physical design, physical risks, simplifying
designs. You know, in the cybersecurity space, a lot of people,
uh face that same problem when it comes to patching. You know, imagine,
I don't know, a power plant with you know, four generating units.
Each unit has I don't know, one hundred PLCs If your PLCs are
on the same network as your control system, which is on the same network
as your plant system, which has a firewall going to the IT network,
and the IT network in turn as a firewall going out to the Internet.
That's a very highly connected environment. Any security assessor coming in is going to
look at this and say, you really need to patch really aggressively everything on
your industrial network because it's so exposed to the IT network into the Internet.
And patching is really expensive. I mean, you would have to take the
plant down in order to change the firmware on the PLCs, and you don't
want to do that. You want to keep producing power, and you need
to test these new firmware images extensively. You know, a lot of people
look at this and say, let's not do that. I know that was
sort of the risk that was identified, and the obvious fixed to you know
we're exposed to attack is to fix the vulnerabilities. But what a lot of
people do is what's called compensating measures. They will put additional layers of firewalls
in the put additional layers of security. They might throw a unidirectional gateway,
and they might air gap the safety systems so that they simply cannot be compromised.
And in this way they reduce this you know, they reduce the risk
by you know, changing the design in such a way that you don't have
to do the really expensive patching thing anymore. So so yeah, I you
know what what Janak is saying here makes a lot of sense. Okay,
So, so big picture risk, UM, when we're when you're looking at
a project, how do you get started with with risk management? The main
key component is that you know, especially the risk management and I'm talking about
large capital projects. UM. We always look at at the very beginning of
the project, how we come up with a better risk process to identify the
risks and then we can quantify the risks so that we can come up with
a better risk response plan. And that's where it's important to bring the key
stakeholders who are involved in the project UM and who has expertise and knowledge about
similar projects in the past, and so that they could actually provide the input
for the current project. So before I get into the steps up that I
think we always emphasize share the current information that that that you know about the
project, so that the participants involved in the risk analysis can understand it come
up with a better risk identification. And so when you look at the risk
identification, we want to be we want to ensure that everybody is committed to
identify the unique risks that are relevant to the project, right, And that's
where we ask the question. I mean, like, for example, when
we identify the risks, we have to think about right away how we're going
to deal with the risks. Right, So sometimes we ask a question the
two important things. We ask about how urgent? How important? So I
can refer to Steven Kobe's time management matrix where you know, Stephen Kobe mentioned
about for like a two by two matrix in terms of one side is on
the urgent, the other side is on the important. So for example,
we get what we call the reactive quadrant where are is actually urgent and important.
That means there's an important risk. There's an urgent risk, and there's
a different way of dealing with that. Right. Then there's a quadron number
two which is not urgent but important. That means we have time to really
identify them. We can you know, we can actually proactively deal with that
risk so that that the team is aware what to do. And then comes
the quadrant three, which is not important but urgent, right, which is
also you know, I mean it's a it's a bit of a reactive nature.
At the same time, it is difficult for us to reject it.
We have to deal with it, right, We have to deal with it
because it's so urgent. And then so we need to deal with it.
And then comes the fourth quadrant, which is like not important, not a
gun. So there's no drivers here, right, and then do we really
want to spend time in looking at them? Right? So coming back to
that step number one, as I said, the identification is very really key.
If the team is not identifying the risks properly, then we won't be
able to come up with a robust risk management applan. Yes, what is
referencing there. I've heard this for years now as the name of it being
the Eisenhower matrix and it being applied to the traits of successful people. But
I guess the point he's making is that it could be applied to risk more
easily because it's sort of universal, that's right. I think he attributed it
to Stephen Covey, who I think documented it in one of his books.
I don't know was it seven habits of highly affective people. I'm not sure,
but yeah, it's it's a you know, I think of it as
a you know, I recall being introduced to it as a time management matrix.
But it applies to risk as well. I mean, you know,
in the cyberspace, you know, what are we talking about? Something that's
both urgent and important. There's ransomware on the OT network. This is an
emergency. All hands on deck, fix this problem. You know that's that
urgent and important. Not urgent but important? Is the risk assessment just came
back. The security assessment just came back. You know, we're in trouble.
We have to fix these problems before some work gets into the control network.
An example of you know, not important, but urgent. We urgently
need to change all of the passwords in all of the devices in all of
our substations. Why Nerk SIP says you have to do this. Yeah,
but those substations they're heavily defended. We've got we've got security in their nine
Ways to Sunday. Nobody can get in there with a password and mess with
the It doesn't matter. If we breach the standard, we risk a million
dollars per day of non compliance. Fine, fix this problem. Fix it
now. I don't care if it's not important security wise, it's urgent compliance
wise. So yeah, this, this matrix you know very much applies in
the cyberspace. In the beginning of the industrial security revolution, engineers were told
to use it security principles, protect the information. We were told. We
knew this was a poor fit, but it was all we had to The
top security priority at industrial sites is safety. Don't kill anyone, don't cause
an environmental disaster. And the second priority is reliability. Do not shut down
our factory or infrastructure. Today, safe and reliable operations use unhackable protections from
cyber risks, not just cybersecurity. For a deeper look at the evolution of
the revolution, we invite you to download Waterfall's report on the Emerging Consensus for
Industrial Security Engineering. You can access the report at the Waterfall website Waterfall,
dash Security dot com, slash Engineering, dash Consensus, or just go to
the resources menu and click on white papers and ebooks. Okay, so we've
we've identified the risks, We've got our matrix of urgent versus important. What's
the next step. The next step is, like, this is interesting,
When I've done many of the fansilitation of risk analysis sessions, people come up
with all kinds of risks. Right, then the question is do you really
understand the risk? If somebody asks you about this particular risk, can you
justify that this risk is relevant to this project? So then we ask questions
like, do you have background understanding about this particular risk? Have you seen
that happening in other projects? Do you think it's relevant for this project?
If it happens for this project, would you be able to really analyze the
problem. Because the reason why we ask the question is questions are if you
identify risk and say, hey, this is a high risk, you know
it's going to be like you know the impact is going to be quite significant,
how do you determine those if you don't understand the risk. So that's
what we call the qualification. So we go through what we call it like
a step after the identification, qualify the risks. Are you really champions of
this risk? So that we can take the identified risks into the quantification stage,
But before that, we need to make sure that you understand the risks
and if someone else in the team asks a question, would you be able
to defend whether these risks are relevant for the project, Okay, And once
we pass that stage, then we can go to the risk quantification stage to
determine two things. What is the probability of occurrence of this risk and if
that risk occurs, what would be the impact of the risks to various aspects?
Right? And I can say that one for example, as I say,
you know my background is in more on the Capitol projects. The two
key things we always talk about the risk manage went is how does this these
risks impact the cost of the project, how they impact the time of the
project or the duration of the project. But you can also look at other
things. You know, the impacting categories could be a reputation, safety,
the performance. Right, So you can actually say, okay, if this
risk happens, let's quantify to say that what's the what's the probability or occurrence
of these risks or the impact if this risks happen. Right. And that's
where, especially when we are dealing it, you know, risk analysis with
you know, stakeholders involving there, we want to make sure that everybody really
understand the process of the quantification. And that's where you always adopt standard methodology
to look at the probability of occurrence. For example, if if I say,
oh, you know what, I have this risk, which is,
you know, very likely that it's going to happen, So somebody would ask
the question, what do you mean likely? Can you define what's likely?
So is your like for example, Andrew, even between you and I,
if I use the word likely in a subjective term, what does that mean
to you? And then if I look at that likely, how do I
interpret likely? So that's where we always look at and come up with a
standard methodology that can say, you know what this risk is. You know,
likely means it is forty percent chance happening, right, or is it
fifty percent chance happening? So we come up with a connotative methodology to define
what we mean by a subjective meaning and then what that subjecting meaning into a
quantitative meaning. So that makes sense. Um, but we're talking about you
know, risk, We're talking about things that might not happen. Um.
You know, I might say, Um, you know, you're operating a
large consumer goods factory and competing with a you know, the same kind of
factory in um in another country, and that country, you know, has
an active industrial intelligence uh wing in their in their government. And I think
it's very likely that the large consumer goods factory, you know, laptop factory
is is going to be targeted with a nation state grade and intelligence agency grade
cyber attack. Um, you might disagree. How do you how do you
resolve these things about events that haven't happened yet. I mean, this is
where Andrew like, there's two things sometimes. You know, when we look
at the risk management and identification, we identify which ones are the strategic risks,
which ones are the tactical risks. In the project management domain, we
consider the tactical risk management is available at the projects for the project people to
handle, whereas a senior management will determine the strategic risks. Even the existence
of a project depends on how they look at the strategic risks. And then
if they think, like the example that you have you given is actually more
geopolitical type of thing, which is actually a strategic type of risk, which
would decide whether we want to go ahead with the project or not. But
anyway, the challenge that I have faced in the quantification of the risk is
that you know, do we think the same way like for example, I
mean, you know, I sometimes use a criteria like it says likelihood of
occurrence. We define them in five different subjective ways. Almost certain. Now,
what is almost certain means to you and me? So for us to
really understand the same consistency, then we define and say almost certain means that
it's going to be anywhere about ninety percent probability, A likely means it's a
high risk that we can say between seventy to ninety percent, A possible means
thirty percent to seventy percent, unlikely means ten to thirty percent, and raya
means zero to ten percent. So we come up with a framework that everybody
is thinking along the same definitions, so that when we identify risks and when
we quantify that we get consistency from everybody. And I think that is also
important in terms of when we look at the impact. So so I'll give
you an example on that as well. Like if you want to come up
with a criteria for impacting a simplest way is maybe on a range of ten.
We can say, you know what a ten plus means, it's a
catastrophic impact in terms of time impact or a cost impact. And you can
say a serious means on a scale of ten, maybe eight to ten.
A moderate means anywhere from four to six, a negligible, negligible means zero
to two. So, for example, we could come up with a criteria
that actually has the words called catastrophic, serious, severe, moderate, mine,
and negligible. But then we can say, what do you mean by
catastrophic impact. Catastrophic impact means you know, depending on the project value,
Like we could say that means we are talking about a five million, five
million additional cost to the project, and we are also talking about six months
delay, right versus a negligible means you're talking about maybe up to ten thousand
dollars in our cost impact with one week of delay, you see. And
I think we need to come up with a subjective nature of the impact and
also put a value associated with that one in terms of the cost and the
time, so that everybody in the team when we analyze the risks, that
there's a consistent mindset about these two things, the probability of occurrence and the
impact. And I'm sure Andrew, you could think of many examples in newer
domain in terms of how do you define the probability of occurrence with relevant to
the risks, and then also how do we see the impact of the risks?
So Nate the you know, the keyword I took out of that was
strategic, sort of strategic versus tactical risks. You know, in a large
organization, think, I don't know, a power utility with forty thousand employees,
lots of different people are involved in lots of different kinds of risk management
at lots of different levels. I mean, you know, individual technicians who
drive out to a high voltage substation, they do not touch anything in the
substation unless they know that it's been de energized. Ideally that you know,
they've de energized it themselves so that they don't you know, get two hundred
thousand volts, you know, flying through them and killing them on the job.
Whereas you know, senior management would tend to deal with risks of I
don't know, uh, you know, an earthquake collapsing the head office and
having to relocate you know, the functions of the head office to a backup
office on an emergency basis. But you know, the at what level of
an organization should you be dealing with cyber risk? And I think the the
the answer that I heard sort of in terms of general principles, is that
the highest levels of the organization have to be dealing with strategic risk. And
you know, strategic risk is risk that puts the entire existence or the mandate
of the organization at risk. So you know, in the example of the
the computer factory that I gave to to janaka Um and you know, the
the the interference with the factory by a foreign intelligence agency that's trying to give
their own factories in their own country a competitive advantage, that interference could be
existential. It could drive the computer factory out of business. For example,
if if pricing information has been stolen from the IT network in this in this
factory, and you know, this allows the factories in the other country to
you know, buy ten cents by a dollar undercut the price of the products
produced by by this factory. Or if you know, they if the intelligence
agency has wormed their way into the operations network and has been tampering with the
devices the plc's controlling production and introducing flaws defects into the product that have to
be repaired at a massive cost. You know, you could this with this
kind of interference, you could drive the factory out of business, the company
out of business. That level of threat is something that needs to be discussed
at the board level. In my understanding, that's a strategic threat, you
know, lower level threats of you know, I'm sorry if we mess with
our if we don't comply with with the law regarding I don't know, uh,
you know, electromagnetic emissions or different kinds of compliance risks might be dealt
with lower in the organization, but you know, strategic lift risk has to
be dealt with at the highest levels, and lesser risks are dealt with you
know elsewhere. Is what I took away here. Okay, So, so
we've identified our risks, We've in a sense prioritize them. We understand which
are strategic you know, we've we've quantified them. What's next, how do
we deal with these? So so now you could actually you could come up
with a nice risk matrix, and the risk matrix will tell us based on
the probability of occurrence and the impact, which ones are high risks, which
ones are low risks, which ones are in the middle. And that's where
you look at it and say, hey, I mean we have a high
risk, which is the probability of occurrence is very high. It's a catastrophic
risk. And then do I want that risks to come all the way down
to a low level where we want to make sure that you know, it's
a rare occurrence of that particular risk or the impact is going to be very
negligible. Right. Oh, somebody said, you know what, No,
let's also look at it in an alternate scenario. We want say that's risks
could could could occur, like you know, it could be possible to occur.
If that happens, that maybe there's a moderate impact because of that risk.
Right. So that's where we look at now a framework about risk response
planning. And that's where the two keywords come back again, the one that
I mentioned earlier called the proactive versus reactive. Right. So, and actually,
you know my domain when I do things, I actually have a kind
of a decision tree built into to both proactive risk management versus reactive risk management.
So what are the different options available when you're dealing with a proactive risk
management Because we see that a potential risk coming in, but we do have
time to eliminate the risk, or to mitigate the risks, or to accept
the risks, or to transfer the risks that the four things that I can
I can elaborate on that. Right, But if you're now dealing with proactive
versus reactive, how do we deal with it? You know, I'll give
you, like, you know, a kind of a simple a decision tree.
We can actually say, you know what, the current probability of a
particular risk is about eighty percent, but we have three choices we can eliminate
it. That means there's an eighty percent chance we want to eliminate it,
like we want to make it into a zero percent that we will never see
this risk. Okay, Oh, we can say in about the current probability
is eighty percent. I mean, let's try and mitigate to about a twenty
percent a probability a ten percent chance of this risk happening. Right, so
we will what can we do proactively to mitigate this risk occurring? Oh?
We can say, no, what I think this is kind of a risk
that I mean, in a project environment, there are various key stakeholders in
there. Let's say we have own a consultant or a contractor or other parties
and say, you know, I think for this particular risk, it may
be better for us to transfer the risk to a party that could better handle
this risk. And so we can think of three options eliminate, mitigate,
or transfer, depending on the nature of the risk. But if you were
to look at a proactive nature of risk, the word eliminate does not exist
because you know, reactive means that something has already happened and you can eliminate
it now. So your choices are either to mitigate the impact of the risk,
which means that you know, we through the risk analysis, we identified
if this risk occur, it's one hundred thousand dollar impact. But I can
mitigate this one by maybe spending maybe sixty thousand dollars so that the impact could
be cut down. Or we can even think about it and say, how
do I mitigate the impact of it. Maybe we do something that it will
not have the same hundred thousand dollars impact, right, Or you know what,
Yes, we can see the signs of this risk. But I think
rather than me as a stakeholder handling the risk, I could probably transfer this
risks into another party who has a better authority or the accountability to handle the
risk. And we could do it in our transferring the risk and then handle
it that way. Oh, you know what, the risk has already happened.
There's nothing much we could do it. Let's accept it and deal with
the problem, right, I mean when you are you know, I've also
done some work in the disaster area, right, you know, particularly the
natural disaster area with respect to you know, tsunamis and then also the tornadoes.
Um and and that's where sometimes you know, you have to accept the
impact of it. I mean, you know, it happened, and how
do we deal with it now? Right? Um? So, so depending
on the nature, as I said, proactive versus reactive, you could come
up with a decision tree that will that will show different options and also will
show the consequences of those options to the project so that you can make it
successful and dealing with the risks. So, I mean, one of the
things that that you know, now that we've had some of the big picture
here, one of the things that always always puzzled me is when you're doing
um, you know, I get deeply involved in cyber risk management, but
not so much you know, management of the risks of earthquakes or of you
know, fires, or of you know, pandemics, who knows what?
And so you know, if you're let's say you're building I don't know,
a hospital, the systems that you're putting in place have to protect the confidentiality
of patient information. The design for the structure has to address the risk of
earthquakes in the region, because we can't have the structure collapsing on all the
patients. The design of the electric system has to allow for backup power supplies
if the main power supply fails, because you've got to keep your patients alive
and electricity is used for that. So you've got you've got different kinds of
risks that you're managing. Do you ever have to trade off one against the
other and say this one's more important, I'm going to focus on it,
you know, the other ones I'm just going to accept, or you know,
is something else going on here? I mean, Andrew, I think
it two different things to look at it. One is that if we identify
exactly the same too risks that you mentioned, if they are important, if
they are that been identified in our risk matrix through the probability of occurrence and
the impact has been critically that we need to handle it. How we handle
it proactive versus reactive is two different things. But also the second one is
at what stage this could happen, Like, you know, is it happening
during the design stage, it could happen in they're during the construction stage,
or is it happening in the commissioning stage. So if they're both important and
we need to tackle them, we don't trade off. We deal with different
strategies to deal with it, right you know, you know, one could
be proactively trying to eliminate that, or maybe the other one could be we
will be reactively mitigated. Right, so that two different things. I mean
I think you know, as the time goes, like cybersecurity, relative risks
are really being critical in many of the engineering and construction projects because I mean
the example you gave in hospitals, research facilities at university daies are becoming really
critical now. So that you know, we don't trade off. But if
it's important, I mean, if it's high, um, then we must
find solutions to deal with that. So Nate um, let let me paraphrase
what I just heard there. I mean, the the the question that's been
sticking in my mind for some time. I mean, you know, at
Waterfall we work with you know, heavy industry We're work with people who are
dealing with you know, powerful dangerous physical processes. You know, they deal
with risk every day. Um. And what I've heard from time to time
from from different stakeholders in these organizations, you know, depending on the organization
is you know, um, Andrew, we're not going to worry about cyber
for now. You know, we have bigger fish to fry, and they
talk about other risks. And this was in a sense, you know,
my goal in bringing Janaka on is to try and understand how does cyber fit
into the bigger picture. And what I what I just heard him say was,
look, Andrew, if you've got a strategic risk, if the existence
of the organization, if the mandate of the organization is you know, has
faces a serious threat, Look, you have to deal with that. The
board has to do with that, the executive has to deal with that.
You cannot ignore material risks, Um, it doesn't matter if you have lots
of risks on the table. You have to at least think about every one
of these risks. And you know that that's an insight I didn't have before
that. You know, you know, the folks deal with you know,
senior decision makers, they deal with the risks, you know, major risks
due to fire, due to earthquake, due to cyber you know, sort
of independently. But you know, it still begs the question where did that
question come from? And this is what you know, let's let's listen back
in again sort of. My next question is is a little bit clarifying in
terms of when can you trade stuff off? And it? You know,
it turns out it has more to do with different threats that have the same
consequence. In a sense, it's the same risk as opposed to different risks.
But you know, if you've got different important risks, the lesson here
is you have to deal with each of them. Instead of talking about,
you know, risks with very different outcomes leaking patient information versus the building collapsing,
can we talk about risks that in a sense have the same consequence.
You know, a solar farm might have motors to move the solar panels to
track the position of the sun. And they might have those motors because if
the motors are working properly, they produce you know, the farm produces twice
as much power in a day. If ransomware gets in there and cripples the
computers, that control the motors and the panels freeze. You only produce half
as much power as you expected for the day. But you also might have
mispredicted the weather. I mean, the weather is variable. Sometimes it's cloudier
than you expect, and you only produce half the power in the day that
you thought you would. You know, you might have a cloudy day dozens
of times in the year. You might have a ransomware incident once every two
or three years. When you have, in a sense, the same outcome
of different causes of risk, is this a time where you might legitimately say
I'm going to trade off how much money I spend on one versus the other?
Is you know when is this what makes them comparable? Yeah? I
mean I think that that's where I give that scenario called if then scenarios like,
for example, you could isolately look at each one of them individually,
or you can look at them in a combined way, like for example,
you know what if a ransomware as well as a cloudy nature would have a
more cumulative impact to the to the far right versus you cannot look at individually,
you know, the cloudy situation. I mean, as you said,
the weather is very random if we don't know that one versus ransomware. So
that's where we have I think that's where the team needs to look at by
looking at all those possible risks coming up, it's scenarios and you look at
those scenarios and then that's where the tools like simulation or decision trees or as
I said, this analytical hierarchy process like hpace, we can evaluate each of
these scenarios and see what's the impact, and then maybe as a result of
that, you could even come up with a better risk management strategy, right
and so, and that's a beauty about but the key is it's a committed
effort to identify these scenarios. When you identify the scenarios, you can actually
you know, analyzing and then come up with a better ways of handling.
And then that also will determine, you know what, we probably have to
proactively deal with these things, maybe we need to invest up front to deal
with it, versus you know, looking at the reactive scenarios of managing risks.
Well, thank you, Joniica. This has been this has been educational
for me. Thank you so much. Before we let you go, you
know, what should our listeners take away from this episode, what sort of
the number one takeaway for you? The key message that I want to make,
I want to pass that one. As an academic as well as somebody
who had dealt with industry and work with industry on the risk management side of
things, I've seen people are making a commitment to do a proper job of
a proper risk management process, where sometimes I see them as a procedural thing
or ad hoc thing. They won't have the commitment that they're simply doing it
because they have to do it. So therefore, my message is that if
it's really really important and particularly in your domain about the cybersecurity area, to
make sure that we do a proper risk analysis to ensure that we identify them,
we really understand them, we qualify them, we quantify them, we
come up with a better risk management risk response options. We look at various
scenarios of if then scenarios to see whether like what's the best way of handling
them right. And that's why we can help from the University of Calgary.
I mean, we have we have experts here in terms of the cybersecurity area
at the University of Calgary that we have you know a two our Computer Science
department and then two our Shuli Sklam Engineering And we have experts actually in other
areas in the Faculty of Law, Faculty of Arts in terms of the policy
side of things, as well as we have expert experts in the risk management
through the Project Risk Managements I through through the Shulik School of Engineering with Center
for Project Management Excellence. So there's a lot of things we can we can
help to support the cybersecurity area. And then I hope that my message is
properly relate to you in terms of make a commitment to do a better risk
comprehensive process and you will be happy and at the end of the day.
All right, So that was your interview with Jonica rwand Pura Andrew. Do
you have anything to take out this episode? Yeah, I mean, I'm
I'm very grateful to you know, doctor Ruan Pura for joining us UM.
You know, I've I don't know, I might have mentioned I've been writing
a book on you know, one of the big topics in it is cyber
risk for years now. I'm hoping to be done by October. But something
that had confused me, you know, time again is talking to people doing
risk management, and you know, hearing stories like, look, you know,
we we have bigger fish to fry than cyber. We're not so much
worried about cyber taking down one of our high voltage substations. You know,
we worry more about squirrels eating through the insulation, getting electrocuted, frying themselves
and short circuiting everything and shutting down the substation. And I'd always try to,
you know, understand, how does how does that fit into the big
picture? Does this really make any sense? And what, you know,
what Jonica cleared up for me was looking strategic risks. Important risks, you
have to deal with them independently. If they're important, they're important, you
have to deal with them. You can't trade off, you know, the
risk of a fire against the risk of ourn earthquake. You have to deal
with these um Where you can legitimately trade off is when you have multiple threats
that have the same outcome. So if you're if you're if the cyber scenario
you're looking at is one that would take down one substation the same way that
a squirrel would eat through the insulation and take down one substation, it's reasonable
to say, how often does squirrels do this, how often to cyber do
this? Is is really worth Is this a problem worth solving? If instead
your cyber scenario could take down the entire grid, you know, that's a
different animal. You can't compare that to squirrels. It's a different consequence.
So that that bit of clarity is something that had you know, confused me
for a very long time. And I'm grateful to Jonica for for you know,
clearing that up for me. All Right, then with that, thanks
to doctor Rwandpura for speaking with you, Andrew, and Andrew is always thanks
for speaking with me. It's always a pleasure. Thank you, Nate.
This has been the Industrial Security Podcast from Waterfall. Thanks to everybody out there listening.