The Doom and Gloom of the Drone Revolution

After a recent presentation at the ASIS Toronto best practices seminar one of the attendees asked if I had any good news and I responded no. Later that evening I realized the perception of how much doom and gloom my presentation had. I have been talking about unmanned systems for some time now and every day I learn something new.

These systems are the next revolution similar to 6 August 1991, when the World Wide Web went live around the world. Now some of the biggest security threats emanate from the internet. However, I think the evolution of this threat will be much faster than the internet. ISIS used a software program similar to Skygrabber, developed by a Russian company and originally intended to download music and videos from the internet, to hack one of America's most sophisticated weapons. It’s funny they learned this trick from Iran after they successfully downed the CIA super drone in 2011.

Criminals and our enemies understand and use technology much better than we thought they would. They exploit technologies that have benefits and turn it against us. So how long will it take for them to put two and two together? Sadly I think they already have done it and they are just waiting. We have countless examples of criminal and radical group use.

The prevalence of this technology has exploded in the last year and continues to grow. One enterprising young individual over at the Hackerspace Knackatory decided to build a quad copter from e-waste (the junk and components like the fans that cool your desktop computer). If you have a 3D printer you can print a quad copter if you so inclined to. So ask yourself -- where does it end?

We cannot afford to react the wrong way and try to law this problem away because it will not go away, remember this is a revaluation. Systems delivering pizza, packages and pills are right around the corner. And if a system can deliver that kind of payload, we must ask: What else could they deliver? The answer to that might not all be good things.

So how do we protect ourselves?

Companies are popping up with detection solutions but what is the point of detection if you have no response. Allow me to explain the “voodoo magic” of effective security. You must have effective Deterrence, Detection, Delay and Response.

Deterrence – visible physical security measures installed to induce individuals to seek other less secure targets.

Detection – physical security measures that allow for early detection of unauthorized intrusion and provide local and/or remote intruder annunciation or assessment.

Delay – security measures that delay an intruder’s access to an asset and provide time for incident assessment and response to arrive

Response – appropriate measures taken to assess, interrupt, and neutralize an intruder

Now apply this philosophy to a rouge drone or unmanned system!

You may have a minor problem with your response. Now if you’re guarding a nuclear power plant you may have the ability to shot down a rogue system, however, if you’re in downtown any major city in the world, then you may have an issue. The FAA on several occasion has tried to fine the fellows at Team Black Sheep $10,000 based on the content of one of their videos.

The skies are wide open and several young enterprising individuals are seeking fame and fortune testing the limitations of society’s tolerance. However, how long until it’s no longer just about “getting that killer video”? During my presentation I give a demonstration of how a person with limited programming knowledge can hack and reprogram an AR Parrot Drone and various applications associated with it do anything. For example dancing and saying hello or flying a completely autonomous flight in what is “controlled airspace” using GPS waypoint.

My point is that if I can do this with limited knowledge of computers and systems then what can someone with the knowledge do?

It may be “Doom and Gloom” but maybe we need to deal with that!

Drones, Drones, Drones

“Drones.” It’s a term picked up by the public and media to describe Multi Rotor Remote Piloted Systems (I know it’s a mouth full). However, in certain groups the correct terminology is key in order to speak the same language. For the last two years I have been researching and studying Unmanned Systems and the potential uses in various industries. I have had opportunities to speak with some of the smartest people -from engineers to physicists and programmers to hardware designers. Every single one of them passionately pursuing their dreams.

Since co-presenting on The Emerging Security Threat from Unmanned Vehicles at ASIS Atlanta 2014, it seems the “Drone” craze is figuratively taking off. During my preparation for the presentation I read countless articles, papers, books have had dozens of emails, telephone conversations and interviewed several experts. I quickly realized how much good and bad can come from this technology. However, the same can be said for any of man’s innovations throughout history.

The Federal Aviation Authority (FAA) is scrambling to develop laws to govern the use of unmanned aerial systems both commercially and privately. Sadly I do not know any person with nefarious intent that will adhere to any law.

Everyday there is something about drones.

Reports are coming in of pilots seeing an unidentified unmanned aerial systems around the airport during landing and take-off the most vulnerable time for an airplane. Nuclear power plants around the United Kingdom and France reporting sightings of unmanned aerial systems flying around the facility. All major cities in the United States and around the world has had some type of unmanned aerial systems incident. New York Police Department Aviation Division chasing an unmanned aerial system that was flying around the George Washington Bridge. Flying around the Golden Gate Bridge cost one man ten thousand dollars in fines. However, the gentleman who crashed his toy on the White House lawn was not fined or charged.

Cartels in Mexico are using unmanned aerial systems to fly narcotics and other high value items over the boarder undetected. They even are using unmanned aerial systems to follow and identify tractor trailers to use in trafficking. Unmanned aerial systems are being used to fly narcotics, weapons and cell phones into prisons. Everyday more and more examples present themselves. Now is the time to take action not later when it’s already too late.

The Emerging Security Threat from Unmanned Vehicles will be presented again at:

ASIS 25th New York City Security Conference and Expo Session 1202, April 22nd, 1000 – 1100

ASIS Toronto’s 22nd Annual Best Practices Seminar April 23rd in Markham, Ontario

The Threat of the Unmanned Vehicles

Security professionals have an opportunity to think through a new threat that is just starting to be used by criminal elements. Now is the time for security professionals to examine the potential threat from unmanned systems and start devising countermeasures that can actually thwart their use in the air, on the ground, and under water. Executive Protection, supply chain security, and business espionage are just a few of the security sectors that must start addressing this emerging threat. This is an opportunity to learn about current systems and capabilities available to the public.

Challenge "SECURITY" to improve its effectiveness

“You can be sure of succeeding in your attacks if you only attack places which are undefended.” -- Sun Tzu

“Emerge from the void, strike at vulnerable points, shun places that are defended, attack in unexpected quarters.” -- Ts’ao Kung

As these ancient Chinese experts on warfare indicate, our adversaries like to study us, determine our weaknesses, find our vulnerabilities and exploit them.

The challenge for professionals is to identify those vulnerabilities. I have found most professionals like to think they know the strengths and weaknesses of their programs. I regularly hear people say: we are the best one’s to assess our program because we know the company. However, it is amazing how quickly we can develop “blind spots” and that is the value of a third party assisting you in identifying weaknesses.

A Red Team is an independent group that challenges an organization to improve its effectiveness. The purpose of identifying these weaknesses is the ultimate goal of enabling you to understand what new countermeasures need to be employed to protect your assets. These assets include and is not limited to your supply chain/ actual men and woman that work with you. A Risk Assessment, that includes a Red Team test of existing approaches, is extremely valuable in achieving that goal.

This is an example of how that concept can work in a live security environment, however, it can also function as a tabletop exercise.

During a strike detail, the security company’s management decided they needed to test their security team’s effectiveness. They had several sites to cover but were concerned with one of the sites, in particular. That particular site maintained several databases that housed all the customer information for the entire east coast, along with all the statistical information for the company nationwide.

A “Red Team” test was designed to see how far a motivated, disgruntled employee could get within the facility without being discovered and what kind of damage could be done. The Red Team came to understand that the facility was very open during operations and there was little or no control over secure areas. This meant that all the employees had knowledge of where critical areas were located and had unchallenged access to those areas.

The Red Team’s task was to attempt to enter the facility and place markers (match books from the hotel where the operators were staying) throughout the facility, and see if they could do so without getting caught. After a several days of surveillance the Red Team decided to do a penetration test during the night shift because it was determined that was when security was most lax and there were the fewest security personnel.

The Red Team entered the facility through the main gate while the security officer was on patrol and that position was unmanned. The team had determined that it took the officer ten minutes to complete his rounds and the security officer was very predictable. Upon entering the facility the team timed its movements to avoid patrols by other security officers. Since the patrol officers never varied their routes and never stopped or doubled back, it was an easy task. The entire facility was approximately twenty thousand square feet and there were five security officers patrolling at any given time.

The Red Team began to make its way through the facility placing markers in critical areas. Some of the areas included a compressed gas cylinder storage room and the server room. One of the Red Team members was even able to access the server using a security code found in an employee’s desk drawer. With physical access to the server room, the team member was able to down load several large files containing proprietary information. As the team moved through the facility they made their way to the office of the company’s Vice President’s office and were surprised to discover a covert camera monitoring system complete with monitors, pan tilt zoom cameras, a digital video recorder, remote data backup, and remote viewer -- none of which were in use and upon further inspection had apparently not been in use for over a year. The system monitored all critical areas, entrances, loading docks, even the lunch room. That system could have been disabled.

The Red Team had placed a total of 32 markers throughout the facility and even placed one under a fire extinguisher less than ten feet away from one of the security officers. During the debriefing, the security officers were all questioned about any activity they had seen the night before, when the test was taking place. None of them said they saw anything. Then one officer said he had seen a bunch of match books on the floor that he didn't remember seeing before but he had not reported it nor did he look around even though, in retrospect, he thought it was strange. Apparently the Red Team member that had placed the match book on the fire extinguisher unintentionally had dropped a few extra books on the floor when he had reached into his pocket to get the matchbook he placed on the fire extinguisher.

The exercise identified vulnerabilities and remotivated security officers to improve their professionalism.

It is important for security and management professionals to realize that being closed minded and thinking they have “good” security is a counterproductive way of thinking. If you believe there is no need for improvement in your security program, you have a recipe for disaster. No one has all the answers but if teamed with a good, professional third party, the resulting “team” can ultimately help provide a safer and more secure environment.

Part of the reason there is a security function is to protect life and property. That means putting aside preconceptions and ego. I have NEVER conducted an assessment or security test that did not identify some shortcomings. This includes some of the supposedly most secure facilities in the world. Guess what…no security is perfect and you can always improve.

"Good security in not cheap... and cheap security is not good". -- BB

Supply Chain Security “SECURITY”

What do you do if you are on a less than truckload shipping route and the carrier shows up with load of illicit contraband on the truck?

What do you do if your inbound shipment is stolen after it just arrived at the terminal and in route to its destination?

What do you do if your shipment arrives at your location and the seal is broken and it was not cut by customs or the carrier?

The answer to these question is nothing (in a sense), unless, you’re in a supply chain security program. In most of the aforementioned examples common sense would prevail and someone may contact law enforcement. However, there is a laundry list of people that need to be contacted and not just the shipper or insurance company.

Even if your organization is not in a government sponsored supply chain security program ie: Customs Trade Partnership Against Terrorism (C-TPAT), Authorized Economic Operator (AEO), Nuevo Esquema de Empresas Certificadas (NEEC) or Partners in Protection (PIP) you are still a part of the Global Supply Chain and therefore have a responsibility to protect it.

A supply chain is a system of organizations, people, activities, information, and resources involved in moving a product or service from supplier to customer. Supply chain activities transform natural resources, raw materials, and components into a finished product that is delivered to the end customer. In sophisticated supply chain systems, used products may re-enter the supply chain at any point where residual value is recyclable. - Wikipedia

At some point is the manufacturing, production and delivery of your wears you need to imagine the hundreds of people involved and fleets of vehicles land, sea and air that are used to get you what you need.

The Customs-Trade Partnership Against Terrorism (C-TPAT) is a voluntary supply chain security program led by U.S. Customs and Border Protection (CBP) and focused on improving the security of private companies' supply chains with respect to terrorism. The program was launched in November 2001 with seven initial participants, all large U.S. companies. As of December 1, 2014, the program has 10,854 members.[1] The 4,315 importers in the program account for approximately 54% of the value of all merchandise imported into the U.S.

Companies who achieve C-TPAT certification must have a documented process for determining and alleviating risk throughout their international supply chain. This allows companies to be considered low risk, resulting in expedited processing of their cargo, including fewer Customs examinations. - Wikipedia

In today’s global economy we rely on each other to be a good corporate citizens to protect and preserve our way of life. Nine out of ten your wears were brought to you by someone in a Supply Chain Security program. Ultimately that someone is responsible and playing an active role in the war against terrorism. It also means that this person reaps the benefits of said program. Reduced number of inspections at the borders , priority processing (front-of-line) for US Customs and Border Protection (CBP)inspections and a several other benefits.

However, in return the CBP expects you to do your part and what does that mean. Simply stated CPB accepts you as a secure “vendor” of sorts but they want you to be sure those you do business with are also secure. CBP will have you conduct a risk assessment of your supply chain and have you advise those to either join a program or become compliant.

Wherever you are in the Global Supply Chain you have a clear responsibility. It does not take much to figure out if you should have some sort of program. Unless your wares are brought to you by one person down the street and they make from beginning to end in there facility with no outside assistance, then consider developing a program.

Remember the questions the correct answer would be:

• Conduct or have someone conduct a risk assessment of your supply chain
• Conduct or have someone conduct a risk assessment of you and your facility
• Develop proper polices and procedure and enforce them
• Train your employees in supply chain security

THE DRONES ARE COMING!!!

We are a few weeks away from ASIS Atlanta and or session on The Emerging Threat of Unmanned Vehicles. We received permission from the Georgia World Congress Center to fly a Unmanned Aerial Vehicle during our session. It is going to be a lot of fun!

Workplace Violence issue still ongoing…

This issue began in 2001. I revisited and wrote an article in 2005. It was reposted in 2008 and now in 2012 is still relevant. Here is a prime example of how something minor can become a major issue… 

Workplace violence still continues to be one of the most significant threats in the business world. It doesn't seem to matter what the business does or where it is located, there can be a threat of violence associated with it. There are many faces of workplace violence and the key is to understand that a threat can come from anywhere. It can be a distraught employee who is being harassed by co-workers in the workplace or is disciplined or terminated. It can be a spillover from a domestic issue, even from a chance encounter.

We will be discussing the issues of stalking in the workplace and how a simple, normal encounter can become a dangerous threat. In the Unites States one out of every 20 women will be stalked in their lifetime. Stalking can start as a simple nuisance but it can escalate into a serious workplace violence threat.

A recent study by the National Institute of Justice found that stalking was far more prevalent than many had thought: eight percent of American women and two percent of American men will be stalked sometime within their lifetime. That's 1.4 million American stalking victims every year. The majority of stalkers have been in relationships with their victims, but a significant percentage either have never met their victims, or it started from a simple meeting with a neighbor, friend or someone met on or off the job. Even if it started off the job, it can impact on the workplace if the threat moves to the workplace location so the employee and other workers are threatened.

When it comes to workplace violence there is no one solution or response. Each incident is unique and should be dealt with properly and promptly.

Several years ago we had an opportunity to assist a large company with a workplace violence issue that had started from a chance encounter between two people who never met before. Because this was a good example of a stalking incident turning into workplace violence, we want to share that situation with you.

It started on a marketing campaign that took one of the owner's daughters, whom we will call Kim, to another state. The daughter had met a man during a one of her father's marketing meetings. She had been sitting in on the meetings in order to learn her father's business so she could eventually take over leadership of the company in the future. During the meeting she met a young man whom we will call Dan. He was a very charming and outgoing fellow and he and the daughter exchanged telephone numbers and then went their separate ways. Over the course of the next year, the two talked on the telephone and began to write each other.

The communications were normal in the beginning, but one day Dan had become agitated and threatened to come over and take care of Kim because she did not seem to value their relationship. Kim responded by asking Dan to not call or communicate with her anymore. But, after a few months, Kim began to again get telephone calls and letters. At first the letters were apologetic. After that, they began to become romantic and sexual in nature. Kim chose to simply ignore the letters. The letters increased in frequency and she then advised some of her associates within the company. They told her to ignore the issue and assured her Dan would tire of being ignored and would stop sooner or later. As time went on the letters slowed down but occasionally she would still receive a letter or telephone call.

As time went on Kim had realized she had a problem because some of the letters were very suggestive. They would detail fantasies of sexual encounters. Dan continued as if he was in a relationship with Kim and kept asking for an opportunity to see Kim. Kim decided to have all her mail and phone calls screened.

This went on for several years and Kim had tried to simply ignore the problem. She moved on with her life, married and began life with her new husband. She also took over her father's company. But the letters continued. Over time, Dan changed the content of his letters from physical attraction to saying that he was the son of her father (hence, Kim's half-sister). It became clear that there was a problem when Dan tried to contact Kim and showed up at the company headquarters, maintaining he was a part owner. Fortunately, security denied him access.

Kim and the company did not know what to do at this time so they contacted our consulting and investigation firm. We began with a thorough fact-finding. After all the information was gathered and interviews were completed, we recommended that some of the latest letters be sent for analysis by a psychological profile expert. Because we had Dan's name and address, the company authorized a full background investigation to confirm where Dan lived. During the background, an investigator was sent to the most recent known address to obtain an updated photo and clarify Dan's current situation. As the investigation progressed, Kim received a call from a young lady who identified herself as Dan's girlfriend. She said that Dan was seeking professional mental health help but had suddenly stopped taking his medication. She also said that Dan was getting ready to take a trip and he would be traveling to the city/state where the company's main office was located. She then explained that Dan was acting very distraught and violent.

The consultants put surveillance on Dan to keep track of him. The consultants also dispatched two teams to the company headquarters location, which was in another state. One team was a surveillance team and the other was an armed protection team. The surveillance team was to keep track of Dan once he entered the state where the headquarters was located. The surveillance team at his home advised that Dan had boarded a bus and was bound for a city near the company headquarters location. Because of licensing/jurisdiction issues, we could not place an investigator on the bus. Instead we posted teams at several different bus terminals and a protection team was sent to be with Kim and her family.

After several days of no contact with Dan we had received a phone call from Dan's girlfriend saying he was back at his home and he was not sharing with here where he had been. We continued to surval Dan at his home. Since we had a person on the inside that was feeding us information, and we had surveillance to confirm actions, we stopped coverage at the company headquarters location and stood down teams there.

At that time we received more letters and forwarded them for analysis. We also got the assessment from the psychologist. He explained that we were dealing with a delusional stalker. According to the expert, this kind of stalker almost always came from a background which was either emotionally barren or severely abusive. The expert said, "These individuals grow up having a very poor sense of their own identities". This, coupled with a predisposition toward psychosis, leads them to strive for satisfaction through another. They yearn to "merge" with someone who is almost always perceived to be of a higher status (e.g. doctors, lawyers, and teachers) or is very socially desirable (e.g. celebrities). It is as if this stalker says, "Gee. If she loves me, I must not be so bad." As Dean Martin compellingly crooned with what could be considered the delusional stalker's anthem: "You're Nobody 'Til Somebody Loves You." It is not unusual for this type of stalker to "hear" the soothing voice of his victim, or believe that the victim is sending him or her cryptic messages through others.

According to the expert, delusional stalkers frequently have had little, if any, contact with their victims. They may have major mental illnesses like schizophrenia, manic-depression or erotomania. What they all have in common is some false belief that keeps them tied to their victims. In erotomania, the stalker's delusional belief is that the victim loves him. This type of stalker actually believes that he is having a relationship with his victim, even though they might never have met. The woman stalking David Letterman, the stalker who killed actress Rebecca Schaeffer and the man who stalked Madonna are all examples of erotomanic stalkers.

Another type of delusional stalker might believe that he is destined to be with someone, and that if he only pursues her hard enough and long enough, she will come to love him as he loves her. These stalkers know they are not having a relationship with their victims, but firmly believe that they will someday. John Hinckley Jr.'s obsession with Jodi Foster is an example of this type of stalker.

Or he can become a vengeful stalker. These stalkers become angry with their victims over some slight, real or imagined. Politicians, for example, get many of these types of stalkers who become angry over some piece of legislation or program the official sponsors. But, disgruntled ex-employees can also stalk, whether targeting their former bosses, co-workers or the entire company. Some of these angry stalkers are psychopaths, i.e. people without conscience or remorse. Some are delusional, (most often paranoid), and believe that they, in fact, are the victims. They all stalk to "get even."

In our example case, the letters continued to talk about how he would get what was rightfully his, Dan also wrote about getting her (his claimed) father back for abandoning him and he would get even with the family. Using the analyses and other information gathered we began to coordinate with law enforcement where Dan lived. Local law enforcement, in turn, consulted with several mental health organization and other professionals in order to come up with a course of action. Law enforcement assisted in obtaining a restraining order in his home state and we were also able to obtain a restraining order in the state where the corporate headquarters was located. Dan was ultimately approached by law enforcement in his home community, served and they explained to Dan that he was not allowed within ten thousand yards of the company locations and family members. After the meeting with law enforcement, his girlfriend said Dan had become very angry and violent. The girlfriend said he told her he was going to take a trip again and would claim his rightful inheritance. The girlfriend said would not be able to help us anymore because she feared for her life and was leaving Dan.

Once again we dispatched a surveillance team to Dan's home and also reactivated the surveillance and protection team back in the state where the company headquarters was located. The surveillance team in Dan's home location followed Dan in order to give the teams advanced notice on Dan's actions, especially if it appeared he was, indeed, going to attempt to go to the company location.

Within a day, we received word from the surveillance team that Dan had boarded a bus. All teams went on high alert. One team was at the bus terminal and followed Dan when he arrived at a nearby city bus terminal. After several days, Dan rented a car and the surveillance team said he was enroute to the city where the company was located. Our surveillance team followed Dan as he attempted to contact Kim and her father. Dan was observed violating the restraining order when he was parked across the street from the family home. Even though he did not exit the car, he had violated the order and local law enforcement was contacted. Our surveillance team directed the police to Dan's location. He was arrested and was mentally evaluated. He was ultimately released and we again survaled Dan as he got on a bus and left the state. Surveillance teams picked him up two days later, arriving home. With all the evidence we had collected, we had enough to have Dan picked up by local law enforcement and have him committed to a mental health facility where he would be treated. Even after release, he was compelled to stay on his medication and was monitored.

This story had a happy ending because the company had a plan, took responsible action and worked with private consultants and law enforcement.

It goes without saying that not all cases have this type of ending. Rebecca Schaeffer and other workplace deaths are proof that failure to act can have tragic consequences. A few years later, the senior management at a distribution center refused our recommendations on developing a workplace violence prevention plan. Within a year, three workers were killed in a tragic shootout at the site.

The sad thing is that many companies have these types of issues but they choose to ignore them, usually because they do not have the background and experience to make good decisions. Almost every week we hear a manager of some company complain that they just don't know what to do in a potential workplace violence matter. We will ask: What does your company plan and training say? Most of the time, they say: We don't have a plan and I've never been trained on this.

Workplace Violence has to do with any kind of violence, or threat of violence, in the workplace. The workplace violence threat should be addressed by advanced training and planning. The planning should be based on what we term a Workplace Violence Planning and Response Plan. There should be training provided with the plan. Management should be responsible for coordinating an approach, in accordance with local laws, for locations within their areas of responsibility.

The local management should use a Threat Assessment and Management (SECTAM) or similar approach. That team will be chartered with the identification, intervention and mitigation of physical threats to people and your company's facilities wherever they are located.

Managers, with the assistance of the SECTAM approach, may become involved in matters such as assault, sabotage, fighting, terminations/hostile meetings, bomb threats, domestic violence, extortion, kidnapping, missing employees, physical harassment, stalking, suicide, terrorism and other significant threat matters.

Our approach recommends using a three-tier system to consider risk factors in workplace violence situations

Tier 1: Low violence potential (e.g. an anonymous, unfriendly email from an external origin; court protection order notification; security assistance for a possibly hostile meeting).

Tier 2: Medium violence potential (e.g. some physical intimidation and/or verbal threats has occurred).

Tier 3: High violence potential (e.g. urgent/immediate response required for intervention when an actual assault has occurred, hostile actions have been carried out or are in progress. If there has been a combination of threatening actions, including specific threats, long-standing harassment or stalking, or an actual assault).

Almost every company we talk with says their most valuable resource is their people. Unfortunately for a lot of companies that is just rhetoric because they ignore issues like workplace violence.

It also should be noted the subject is still a ward of the state and was denied release twice…

“Resilience”

The January 2012 article in ASIS International’s Security Management magazine has an interview with Dr. Stephen Flynn,  who is a major “think tank” guy and professor at Northeastern University in Boston.  Here’s one of his answers:

The Obama administration has not changed far enough. They’re tilting in the right direction, but I think more movement needs to happen more quickly.  To the credit of the administration, they’ve embraced the concept of resilience  - a public acknowledgement that every act of terror cannot be prevented and some capacity to respond and recover from them is necessary.  That’s difficult for political leadership to say, but the president and Homeland Security Secretary Janet Napolitano have said it, and that’s a necessary dose of reality.  The Obama administration has also gone a bit further than the Bush administration with the all-hazards recognition of the importance of what FEMA’s Craig Fugate calls the “whole community approach.”  I give them credit for recognizing that homeland security needs to expand beyond a narrow focus on terrorism risks to include the broader issues of all hazards and that there needs to be a greater degree of outreach and engagement of communities.”

Couple that with the latest issue of Inside Home land Security (Winter 2011) issue in which Dr. Dave McIntyre, VP for Academic Affairs at the National Graduate School and Visiting Fellow at both the Homeland Security Institute and WMD Center, wrote in his article: Reducing the Risk of Risk Management.  He said:

The traditional approach sees risk as a product of an attacker’s intent, the vulnerability of a target and the consequences of a successful attack.  In forecasting the risk of a natural hazard, likelihood of a disaster may be substituted for an attacker’s intent and capability.  Whatever system of calculation is adopted, someone (or some team) must place numerical values on each aspect of the calculation and then adjust the weight of factors for qualitative differences.  For example, if the calculation of risk to a warehouse and an elementary school turn out exactly the same, you might want to weigh the loss of children more heavily in terms of consequence, than the loss of materials (consequences).  Are Risk Management and management of risk the same?  Many experts say yes. But if Risk Management deals with cycles, processes and allocation of resources over time…then what do we call the day-to-day manipulation of available resources to meet threats?  Are police or security on patrol really risk managers?  Or are they managing the day-to-day risk?  Perhaps we need two different terms for these two different activities.