The fastest way to get CISSP Certified. Join our bootcamp
On August 1, 2012, Knight Capital was one of the biggest stock traders in the US.
Four days later, it needed $400 million from outside investors to stay in business.
The night before, Knight rolled out new trading code to eight servers. One server missed the update. That server still had code for an old feature called Power Peg, which Knight had stopped using in 2003, and the new release reused a setting that used to switch Power Peg on.
At the opening bell, the eighth server started running Power Peg. The part of the code that should have told it to stop no longer worked.
In 45 minutes, Knight's router sent more than 4 million orders into the market while trying to fill 212 customer orders. It traded more than 397 million shares. The loss came to more than $460 million.
Before trading even started, Knight's own system had sent 97 automated emails about the problem to a group of staff. Nobody acted on them before the open.
By December, Knight had agreed to be acquired.
Most people read this as a technical failure.
It was one. Nobody checked that all eight servers matched. Dead code sat in production for nine years. A setting got reused without anyone testing what it might still switch on. If you've studied for the Certified Information Systems Security Professional (CISSP), you'll recognize change management, configuration management and testing.
The SEC saw something else.
When the US Securities and Exchange Commission (SEC) charged Knight in 2013, it pointed at how the firm handled risk. Knight's risk assessment had mostly listed existing controls and checked that they worked. It hadn't looked hard at what could go wrong with the order router itself.
That changes the questions:
- Who owned the risk of a trading system running out of control, and did they know it was theirs?
- Knight got its warning 97 times. Whose job was it to act?
- Who had the authority to stop the system, and how fast could they do it?
Those are risk questions, and they're the ones the Certified in Risk and Information Systems Control (CRISC) certification is built around.
If you hold CISSP, about 20 to 25% of CRISC will feel familiar, and the rest is this kind of thinking. Our new CRISC MasterClass is in pre-sale until Sunday, Nov 15.
Rob & John
The CISM exam changes November 3. New content areas. Updated outline.
Our CISM Bootcamp is already aligned to the new blueprint. Whatever date you sit, you're preparing for exactly what ISACA tests.
The CISSP CAT Exam Simulator is now available to all students
Included with the CISSP MasterClass and the CISSP Bootcamp.
Students, it's in your dashboard now.
Destination AAISM: The Complete Guide is here
All three AAISM domains covered, built the same way we write our CISSP and CCSP guides: heavy on diagrams, light on filler.
Destination CCSP just got a major update
We've refreshed the guidebook to match the latest exam outline, with AI/ML security now woven through all six domains. Same clear explanations that have helped thousands pass, updated for what ISC2 tests today.