Security Fundamentals
Core risk concepts
Everything in a security program traces back to risk. Treat risk as a function of threat (who or what can cause harm), vulnerability (a weakness the threat can exploit), and consequence (impact if it happens). A common working formula is risk = likelihood x impact; scoring both on a defined scale lets you rank findings and justify spending. Residual risk is what remains after controls; you never eliminate risk, you manage it to a level the organization accepts (its risk appetite or tolerance).
Program building blocks
Know the risk-management cycle: identify assets and threats, assess, treat, monitor, and review. Treatment options are avoid, reduce/mitigate, transfer (insurance, contracts), and accept. Layer defenses (deter, detect, delay, respond) so no single failure is fatal, and apply CPTED and target hardening deliberately rather than by habit.
Traps
- Compliance is not risk management: a checklist can pass while real risk stays high.
- Due diligence (investigating) versus due care (acting reasonably).
- Choosing the "strongest" control while ignoring cost-benefit and usability.
- Confusing a vulnerability (a gap) with a threat (an actor).
Rule of thumb / worked example
A warehouse has a documented loading-dock gap (vulnerability), active cargo-theft groups in the region (threat), and a $2M annual exposure (consequence). Likelihood high, impact high, score 16. The recommended control is locked dock doors plus camera coverage and a verification procedure, cutting likelihood to medium (score 8). Present before-and-after residual risk along with cost, not just hardware.