Swiss Cheese

I’ve done some pretty dumb things in my various sports over the years. I’d like to believe I’ve gotten better at risk management with time and yet if that’s true then I also don’t want to let myself know lest it breed complacency. Sometimes I tell myself that being both a security professional and an extreme sports enthusiast make for a useful kind of cross-training but for that to be true then I have to be disciplined enough to listen to that inner pessimist when temptation calls.

Today I found myself looking fondly down upon one of my favorite routes at Alta, Extrovert, wanting to go play there but also deciding that to do so in this moment would be folly. The snow looked nice and yet the conditions seemed likely to engender a “shark attack” that I might not weather well.

None of my areas of concern were by themselves a deal breaker but when viewing them in concert the equation did not quite add up under the Swiss Cheese Model of risk. Sometimes wisdom looks like taking a page from the successful criminal’s playbook — only commit one crime at a time.

Actually, in many contexts multiple coincident crimes may be okay, but in general the fewer the better, and some are more dangerous to combine than others. Today my standout concerns numbered three — cloud base was low enough that I was intermittently “skiing by braille”, early season conditions had lots of objects exposed to ski strikes while not being particularly visible, and my shoulder is of a state where it would probably survive a fall but I suspect leave me in agony for a week or so. Were any of those three things not true I probably would have been happy enough to take that route but in the moment too many holes seemed to line up for a bad outcome.

Similar issues arise all the time in systems engineering. Choices that look sloppy or reckless in isolation may be tolerable enough when viewed through a lens that considers mitigating factors and opportunity costs. Tools that chronically sound the alarm on theoretical security issues that when viewed in a larger context are innocuous are likely to be silenced. Life is short, some risks are more serious than others, and if you try to reduce risk to zero then you won’t have nearly as much fun as you ought. As @patio11 notes, albeit somewhat contextualized to the financial domain, “the optimal amount of fraud is non-zero”. All that said, you should endeavor to drive your Risk Of Ruin to zero, as there is plenty of fun to have later if only you can manage not to maim or kill yourself today.

I try to anchor my paragliding go/no-go decision for every flight to one simple question — “do I want to gamble every future flight on this one?”. Happily, and with some regularity, the answer has generally been “hell yes!”. But all I have to do is call that shot really wrong just once and that’s all she wrote. Sometimes I get it right while other times I’ve had to rely on the most unreliable of friends, luck, hope that I remember my training, and occasionally be tough enough to survive going splat.