I find myself talking about concepts like “risk posture” and “security posture” more and more. Most people politely nod along like they understand the terms. However, “risk posture” has a specific meaning – where an organization as a whole and its assets (things with value) stand relative to risk (likelihood and impact of a threat exploiting a given weakness).
Someone loves this motorcycle. I’m not a cruiser person, so I can’t tell exactly what model it is, but someone took a Harley, converted it to a more extreme chopper style bike, repainted the tank and rear fender, set up exposed drivetrain, and made a decent number other stylistic changes.
Despite all that work, at some point in the last few years, the original kickstand disappeared and the owner had resorted to using a piece of scrap wood as a kickstand.
If you’ve never owned a motorcycle, motorcycles are heavy and unstable when stationary or being dismounted and parked. Everyone who owns a motorcycle has either dropped a motorcycle while parking it or working on it, or will drop a motorcycle at least once in the future. Putting the kickstand down won’t necessarily immediately stabilize a motorcycle when parking – my first motorcycle, a Honda CBR300R, had such a tall kickstand that it frequently almost tipped over if parked on any surface that wasn’t perfectly level and smooth. My current motorcycle, a Royal Enfield Himalayan 411, has an aftermarket shortened kickstand because the previous owner felt that the original kickstand was too tall to safely park the bike on any sort of incline.
The owner probably doesn’t think that carrying a loose 4×4 around in lieu of a kickstand is a big deal. However, this decision influences risk posture in terms of literal posture. Substituting a piece of scrap wood for a kickstand takes a risk that already has a high probability of occurrence (dropping a bike) and further increases the probability of that risk.
The impact (literal or figurative) of dropping a bike isn’t that high. You might break a clutch lever or a mirror, which are neither particularly expensive nor difficult to replace if those parts are available. You can have issues from fluids spilling/settling where they shouldn’t (especially with a carbureted bike), which are also relatively easily resolved with the proper tools and spare fluids.
Taken in the context – this picture was taken in Virginia City, Nevada, which is about 14 miles from the outskirts of Reno. A broken clutch lever in VC isn’t that big of a deal, but traveling any further away from Reno or Carson city would put you hours and hours away from any shop that might have replacement parts if you dropped your bike and broke the wrong part off.
We all have things like this kickstand. People think that having one service account excluded from standard security policies, or having one server use SMB 1.0 isn’t a big deal, because that “temporary” solution or minor exclusion has been in place and ignored around for months and months and decision makers have become complacent. But, to a hostile third party, those seemingly minor decisions can be exploited to have a sizeable impact. A tip-over that breaks a clutch lever in the Honda dealership parking lot is a complete non-issue (other than embarrassment). Breaking a clutch lever or, with terrible luck, snapping a shift lever off or other worse damage halfway between Virginia City and Tonopah in August weather can turn into a serious issue where, at best, you’re riding for hours and hours with controls that don’t quite work (risking a crash at speed) or at worst, the bike is fully immobile until replacement parts are available. Risk posture needs to be undestood both in the context of an organization as a whole, and evaluated by a new or third party set of eyes to ensure that complacency doesn’t leave an organization hanging out to dry on the side of the road in the desert.