What could go wrong? As an information security manager, I am often asked that question. But, there are two ways it is asked.

The first is my preferred way. It is a genuine effort to identify and evaluate the risk associated with the item at hand. That is a conversation I want to have. That is a thought process I want to encourage.

Then, there is the other way the question is asked. Instead of trying to identify risk, it is asked as if to imply that there is nothing that could possibly go wrong with whatever is being proposed, and only a fool would think there would be.

Let’s examine four cases to see what could go wrong even when asking the right questions. Read each one and stop to ask yourself what could go wrong before reading the outcome.

 …