Security and Risk Management
Governance and the risk vocabulary
Every risk question reduces to a few precise definitions. A threat is a potential cause of harm; a vulnerability is a weakness a threat can exploit; exposure is the state of being susceptible. Risk combines likelihood and impact, so an asset carries total risk before controls and residual risk after them. Controls are categorized as preventive, detective, corrective, deterrent, recovery, or compensating - picking the right category is a recurring question type. Senior management owns risk; the practitioner quantifies and advises.
Risk treatment has four outcomes: mitigate, transfer, avoid, accept. Acceptance is legitimate only when an authorized manager documents it; items showing an analyst quietly accepting risk test escalation. Transference (insurance, contracts) moves financial impact, never accountability.
Distinguish due diligence (investigating and verifying, e.g. vetting a vendor before signing) from due care (the ongoing practice of acting on what you learned). Also separate policy (management intent), standards (mandatory specifics), baselines (minimum configuration), procedures (step-by-step), and guidelines (recommended).
The ISC2 Code of Ethics is ordered: protect society and the common good; act honorably, honestly, justly, responsibly, legally; provide diligent and competent service; advance and protect the profession. When canons conflict, the earlier one wins.
Rule of thumb
SLE = asset value × exposure factor; ALE = SLE × annualized rate of occurrence. A $200,000 asset losing 25% per event, with one event every two years, gives SLE $50,000 and ALE $25,000 - so a $10,000 control pays for itself. Compute before comparing options.