I recently got asked about the Covid-19 crisis and how to go about protecting a business from it. I was specifically asked the following question:

1. What kind of systems do you set up?
2. How did you choose which attack vectors to prepare for?
3. Do you have various layers of protection, and if so, what do they look like?

Circles of Defense

Circles of defense is a system of creating various kinds of barriers in an effort to protect ourselves/our businesses from potential harm. The guiding principle behind the circles of defense is to build various layers of defense between the asset we're protecting and a possible danger. No single method of defense is 100% impregnable (each has it's strength and weaknesses) and that is why various circles must be put in place around each asset for each potential danger.

Every circle should aim to either disable the danger from affecting us by either distancing us from it, blocking it, providing a deterrent, or having a counter measure at the ready. At the very least each circle should act as a stalling mechanism that alerts us and gives us enough time to "switch on" and be ready to address the potential danger.

Advantage of Having Circles in Place 

One giant upside of having these circles of defense in place is that they can act as a kind of alarm system if you will. Once we notice that once circle has been comprised we immediately know that something is wrong and can go from "business as usual" to "Crisis Management" mode.

There are 2 components that cause a situation to be deemed of higher or lower "Risk". "Danger" and "Control". Those 2 main components are comprised of 4 subcomponents.

Let's start out with "Danger" as that will help us quantify which attack vectors we should prepare for:

Danger

The first main component of "Risk" is the "Danger" itself that we are facing.

How the Three Subcomponents Interact

Magnitude of Possible Harm + Immediacy of The Threat + Probability = Level of Danger

I call these layers of protection "Methods of Control". I'll first explain "Control" and then methods. Please also note that not all of these methods will be applicable to all situations. They are meant to be used as a guiding principle and a reference point for decision making.

Control

The second component of "Risk" is control. Control comes down to how much influence do we have over the outcome of a situation. Can we somehow contain the danger, prevent it from affecting us or possibly overcome it by using the various tools and abilities we posses?

Can we in some way decrease its magnitude of harm, make it less immediate, or make it less probable to happen?