I recently got asked about the Covid-19 crisis and how to go about protecting a business from it. I was specifically asked the following question:
- What kind of systems do you set up?
- How did you choose which attack vectors to prepare for?
- Do you have various layers of protection, and if so, what do they look like?
1. What kind of system do you set up?
Circles of defense
Circles of defense is a system of creating various kinds of barriers in an effort to protect ourselves/our businesses from potential harm. The guiding principle behind the circles of defense is to build various layers of defense between the asset we’re protecting and a possible danger. No single method of defense is 100% impregnable (each has it’s strength and weaknesses) and that is why various circles must be put in place around each asset for each potential danger.
Every circle should aim to either disable the danger from affecting us by either distancing us from it, blocking it, providing a deterrent, or having a counter measure at the ready. At the very least each circle should act as a stalling mechanism that alerts us and gives us enough time to “switch on” and be ready to address the potential danger.
Advantage of Having Circles in Place
One giant upside of having these circles of defense in place is that they can act as a kind of alarm system if you will. Once we notice that once circle has been comprised we immediately know that something is wrong and can go from “business as usual” to “Crisis Management” mode.
2. How do you choose which attack vectors to prepare for?
There are 2 components that cause a situation to be deemed of higher or lower “Risk”. “Danger” and “Control”. Those 2 main components are comprised of 4 subcomponents.
Let’s start out with “Danger” as that will help us quantify which attack vectors we should prepare for:
Danger
The first main component of “Risk” is the “Danger” itself that we are facing.
The 3 Subcategories of "Danger"
The Magnitude of Possible Harm
How severe could the attack be. How fatal could it be to us or to our business?
- Will it leave us in ruin or will it cause a bit of a headache?
The Immediacy of the Threat
On a timeline, how close is it to actually happening? How urgent of a threat is it?
- Is this something that will happen this month or in ten years?
The probability
What is the likelihood of the threat actually being carried out? How plausible is it to actually happen?
- Is this something that is guaranteed to happen or have we heard a rumor that some new change might possibly come into affect?
How the Three Subcomponents Interact
Magnitude of Possible Harm + Immediacy of The Threat + Probability = Level of Danger
3. Do you have various layers of protection, and if so, what do they look like?
I call these layers of protection “Methods of Control”. I’ll first explain “Control" and then methods. Please also note that not all of these methods will be applicable to all situations. They are meant to be used as a guiding principle and a reference point for decision making.
Control
The second component of “Risk” is control. Control comes down to how much influence do we have over the outcome of a situation. Can we somehow contain the danger, prevent it from affecting us or possibly overcome it by using the various tools and abilities we posses?
Can we in some way decrease its magnitude of harm, make it less immediate, or make it less probable to happen?
Methods of Control
Distance Management
If we can create enough space between us and the potential danger then we will stay safe as long as that distance is maintained. If we can control that distance and maintain it then we have good control.
- For example the Corona Virus is bringing in person events/conferences to halt. But if you can bring your events online you distance yourself away from that problem/danger.
Barriers
If we can put between us and the danger a strong barrier of some sort, that blocks the danger, then we will be safe as the danger won’t be able to affect us. There are also weaker barriers that would in some way or form diminish the danger or weaken it.
- A financial crisis seems to be looming around the corner. If you can make sure your business is set up correctly and that potential losses won’t bleed into your personal accounts you’ll create a financial barrier for yourself against the possible recession.
Deterrents
If I can openly present my ability to counter and overpower any would be danger and the person/company wielding it I may be able to deter them to a point where they see it as undesirable to engage me. By deterring an attacker I can possibly avoid the danger altogether.
- A classic example of this in business is the threat of a lawsuit. A lot of companies will try to run away from previous commitments. If you have these commitments in writing this is something that you can bring up.
Counter Measures
If we can overmatch a potential danger’s ability to inflict harm and impose OUR will on it, then we have a measure of control over the situation. It’s important to understand that if we have gotten to the point where we engage with any danger under any circumstances there will be a higher measure of risk involved. Relying on counter measures should only be a last result!
- Actually going to court and facing a possible judgment that’s not in our favor.
Control Method Hierarchy
These methods of control are in a descending hierarchy from safest to least.
- If we can avoid the danger altogether by staying away from it, that’s the optimal situation.
- If we can’t avoid it we want to at least have a barrier between us and the danger.
- If we don’t have a barrier in place but, we have a strong deterrent, then that might benefit us by causing someone who can inflict harm on us to choose not to engage us.
- If we don’t have a deterrent strong enough to reduce their desire to engage us, we want to at least have a stronger counter measure that will enable us to overcome them.
Risk
Danger - Our ability to Control it = Level of Risk
Methods of Control
Subcategories of Danger
Summary
Danger will consist of:
- The magnitude of harm a threat consists of.
- The immediacy of it
- The probability of it.
Control is our ability to manage the danger by avoiding it through:
- Distance management.
- Blocking the danger through barriers.
- Deterring the danger through intimidation.
- Overcoming the danger with counter measures.
Danger - Our ability to Control it = Level of Risk
Free Covid-19 Business Help
The Corona Virus is creating a lot of stress in the marketplace and there will be ramifications. If you need someone to talk to about how to prepare for crisis, set basic contingency plans, stay calm and lead at these times - let me know.
It's a hard times out there and we're not the best at asking for help.