For every first lesson I teach about Risk Management and Contingency Planning, I always like to raise an example to begin a discussion about the illusions of human beings.

This illusion is best illustrated by an interesting game called the Monty Hall Problem, which goes like this:

Suppose you are a lucky game show player who is picked to participate in a game. The game requires you to stand in front of the three doors. Behind one door is a car, and behind each of the other two doors is a goat. You are told to choose one of the doors, and if you choose the door to the car, you win the car.

The game requires you to make your choice, and then the host (who knows what is behind each door) will open one of the other two doors that he knows does not open to the car. According to the game rules, you have the chance to change your mind and choose the other remaining door, or remaining with your original choice.

The problem is: Should you pick the other remaining door, or trust your first choice? Would this decision make any difference in the chance of winning the car?

Most people will say that the chance is the same for whichever choice because you have half the chance to win the car out of the two remaining doors. It sounds logical, doesn’t it?

But let’s examine this carefully. Suppose you label these two strategies as:

Strategy A:  Remaining with the present door choice.

Strategy B:  Changing the choice to pick the other remaining door.

Let’s take a look at Strategy A first, where there are two outcomes:

Strategy A, Outcome 1: Your original door choice was the one if front of the car all along, and you win because you chose to remain with the first door you picked. The chance of you picking the door with the car at the beginning of the game was 1/3 because you had to choose one out of the three doors.

Strategy A, Outcome 2: Your original door choice was one of the two doors in front of a goat, and you lose because you chose to remain with this first door you picked.  There is 2/3 of chance for this scenario to take place, since two of the doors had goats behind them.

So for Strategy A, you had only a 1/3 chance to win the car.
What about Strategy B, where you change your original choice?

Strategy B, Outcome 1:  You change your door choice, and unfortunately your new door choice is hiding the other goat. You lose. Remember you have 1/3 of chance in this outcome as discussed previously.

Strategy B, Outcome 2: You change your door choice, and open the door hiding the car. You win! And you have 2/3 of chance in this outcome. (If you’re interested in a full explanation of how the outcome changes to 2/3, search for the term “Monty Hall Problem” using your favorite search engine and you’ll find plenty of information.)

Looking at the problem this way, it’s quite obvious that Strategy B is a better choice, isn’t it?

Some of you might still feel confused. You might need to re-read the whole discussion above to clarify your thoughts.

Ultimately, this game illustrates one very important weakness of people: We tend to jump to conclusions for many problems too easily without careful analysis. And worst of all, we are usually over confident as to what we have concluded at the beginning.

This problem is closely related to the people issue in Information Security or Corporate Risk Management. People tend to overlook many possible system vulnerabilities when undergoing so-called “risk analysis”. They are not aware that they have been overly naïve when thinking about the possible threats to their system of operations.

It’s quite interesting that this phenomenon is well observed now, as there are so many financial institutions around the world running into their own financial problems because the people who run those organizations were too confident in themselves to manage the risks. And indeed, they seem to be completely blind to the possible exposure of managing and holding all those financial products they have on hand, without even thinking about the possible serious consequence of dragging down their own companies if things go against them. And indeed, it catches up to them in the end.

So in the risk management exercise of information security, the number one beneficial attitude is to be humble. We need to realize that we are not invincible, and be very careful in weighing all possible risks related to the information system we are using. We have to work out the plan in every step of risk management without the tendency to overlook or jump to conclusions too easily. Without the right mind set, we are very likely to fail to manage all possible risks properly.

Tags: Corporate Governance, IT Governance