His perceived risk was improperly supported, which led to a massive investment in a defensive line which was ultimately ineffective.

Had Maginot studied risk assessment, he would have realized that risk (R) is the product of threat (T) and vulnerability (V), (sometimes expressed as T x V = R). Properly described, risk is the combination of the impact and likelihood of an event which impacts the mission, functions, image or reputation of an organization.

Overall risk to the organization/entity is the sum of all of the risks described in their Risk Catalog which represents the portfolio of relevant risks. Following this process can help your organization to build appropriate controls and avoid an outcome similar to Maginot. The overall process for a comprehensive risk assessment may be summarized in the following steps:

1. Develop a Threat Catalog describing the universe of applicable risks;
2. Determine the Relevance and Impact of each Threat to produce the Threat Value;
3. Examine the Vulnerabilities and Pre-Disposing Conditions to determine the value for Vulnerability;
4. Determine the Inherent Risk as the product of Threat and Vulnerability;
5. Apply the Risk Treatment process applicable to the organization to the Risk Catalog to determine which risks will be Mitigated in the Controls Environment;
6. Based on independent testing, determine the Design and Operating Effectiveness of the Controls Environment;
7. Subtract the Controls Value from the Inherent Risk to determine the Residual Risk; and
8. Compare the Residual Risk both in aggregate and for each individual risk to the Risk Tolerance of the organization

This disciplined approach will provide insight into allocation of resources and the alignment of controls with the risks to the core business of the organization.

John Rostern is managing director, Northeast, for Coalfire Systems.