Security Principles and Practices
What security is for
Security protects people, information, and assets so the organization can take business risks deliberately rather than accidentally. Every decision a protection professional makes should trace back to a business objective - a control nobody needs is as wasteful as a gap nobody saw.
The core mental model
Risk is a function of three things: a threat (an actor with intent and capability), a vulnerability (a weakness the threat can exploit), and a consequence (the harm if exploitation succeeds). Questions routinely test whether you can separate them: an unlocked server-room door is a vulnerability, a burglar is a threat, and stolen equipment is a consequence. Risk is never eliminated; it is managed. The four treatments are avoid, reduce, transfer, and accept - and accepting a risk is a legitimate, documented decision, not a failure.
Traps
- Confusing due diligence (the ongoing process of identifying and evaluating risk) with due care (the reasonable actions taken in response).
- Assuming insurance removes a risk; it transfers only a financial slice of it and never accountability.
- Believing policy alone changes behavior. Policy, procedure, training, and enforcement are a package.
Worked example
A distribution center loses about $90,000 a year to pallet pilferage through a propped-open dock door. Threat: employees and outsiders. Vulnerability: an unmonitored door with no alarm contact. Consequence: annual shrink plus insurance premium creep. A $25,000 card reader, door contact, and camera package cuts expected loss to $15,000 - a $75,000 annual benefit and a payback under five months. That is a defensible spend; "we need cameras" is not.
Rule of thumb: never rely on a single control. Layer people, process, and technology so that a failure in one layer is caught by the next.