Does climate change have any relevance for information assurance and business continuity? My friend and colleague John Orlando, program director of the Master of Science in Business Continuity Management (MSBC) program at Norwich University, thinks so. Here's his contribution to the discussion.

* * *

I [John] had just gotten off the phone with one of the professors in our MSBC program. We were discussing the difficulty in measuring risk. Although business continuity programs are traditionally justified on grounds that the money spent will be well spent through prevention or mitigation of losses due to business disruptions, it is actually very difficult to assess risk accurately.

One problem is that people tend to overstate risks that have a psychological impact. For example, many people fear flying over driving, even though driving is the greater risk. People rank terrorism as a high risk, even though it is a much lower risk than accident or crime. We also tend to understate the danger of events that have not happened in a while.

No sooner had I hung up than an e-mail appeared from the university warning that there was a tornado watch for the area. On the way home that evening I told my carpool mates that tornados are not an issue in Vermont – as they are in Wisconsin, where I grew up – because mountains break them up. My wife and I have lived in Vermont for 15 and 20 years, respectively, and there has never been a tornado in Vermont in all the time we have lived in the state. I also told them that the instructions in the message were mostly wrong. Being from Wisconsin, I know tornados.

Talk about getting egg on one’s face! When I arrived home, there were police all over my neighborhood. Huge trees were ripped out, including a big one in our backyard that luckily missed the house. A house a few hundred yards from us had a tree take out its top floor and porch. It is not clear if an actual tornado hit our neighborhood, but a pre-tornado funnel cloud was sighted heading our way just before the 70 mph winds hit, which are the strength of a weak tornado.

The next day I went to a tornado Web site where I learned that some mountainous areas do get tornados, and most of what else I thought I knew about tornados was wrong.

M. E. Kabay, PhD, CISSP-ISSMP, is Program Director of the Master of Science in Information Assurance program at Norwich University.