Kenneth Pettersen

A framework for selection of strategy for management of security measures

In this paper, we present and discuss a framework for security risk management, focusing on the selection of a management strategy for decision-making on security measures in particular. The framework provides guidance on the selection of a suitable type of management strategy for various types of decision-making contexts. An Information and Communication Technology case study is used to illustrate the practical implications of the framework.

Risk analysis and Black Swans: two strategies for de-blackening

With his book The Black Swan: The Impact of the Highly Improbable, Nassim N. Taleb brought the Black Swan metaphor to the center of risk analysis debates. His main thesis is that the course of the world is determined by the sudden coming of a small number of high impact events whose occurrences are detectable only through hindsight. When relying on prediction, risk analysis is doomed to fail. The standard route of refutation and rehabilitation of predictive practices has been to oppose Taleb’s worldview. In this article, we develop an alternative route of refutation in which we separate Taleb’s claim of unpredictability from his worldview. Moreover, in our justification of the possibilities of predicting in a Black Swan world, we favor an extension of the Black Swan domain so that it includes unknown knowns in addition to unknown unknowns. The article advocates for a bridging of perspectives in which predicting not only involves the sphere of knowledge, but also the sphere of imagination, bringing the risk communication to the fore. Related to the analysis of extraordinary high-impact events, the merits of an imaginative perspective on prediction is illustrated by the terrorist attacks in Norway on July 22 2011, and some key challenges for further developing such a perspective within risk analysis are sketched.

Evaluation of comprehensive security systems for public transport – a methodological approach

This paper presents a risk-based framework for debating and evaluating the benefits and costs of security capacities for the public transport sector. The framework takes into account non-quantifiable decision variables and dilemmas, and uncertainties related to input data. The framework consists of process description and a range of suggested evaluation criteria as well as guidelines on how to perform the evaluation. The criteria cover expenses, legal and ethical challenges, passengers’ perception, other side effects, and feasibility. In addition to guidelines on prioritizing and evaluating the different criteria, the interpretation and use of the numerical results is discussed. The framework also discusses the follow-up management strategies based on the outcome of the evaluation. In short, it describes a possible way of following up the output of security risk assessments and the identified security gaps/risks. It involves stakeholders and offers a transparent process for prioritizing, and finally, selecting security measures. In its simplest form, the whole evaluation can be conducted by experts in a workshop, making qualitative assessments of a few criteria. This can be useful as a first screening for choosing capacities/measures for further studies. More advanced users can apply quantitative studies and surveys; however, the framework will remain the same. The use of and the strengths and weaknesses of the framework has first been pre-tested in a constructed practical case, in which a fictional personal transport operator was expected to choose among five possible security capacities to mitigate a security gap (risk), and thereafter, tested in a real case by a small public transport operator.