Technology and Security
Controls mapped to the technology stack
Risk practitioners need working literacy across architecture, security operations, and resilience, always linking technology to business risk. Core concepts include the confidentiality, integrity, and availability triad; identity and access management (least privilege, role-based access, segregation of duties, privileged access management); encryption in transit and at rest with key management; network segmentation, firewalls, and intrusion detection or prevention; logging and monitoring; secure development life cycle with stage gates; change and configuration management; and patch management. Resilience concepts include business continuity and disaster recovery, with recovery time objective (how long until restored) and recovery point objective (how much data loss is tolerable).
Modern scope adds cloud shared-responsibility models (the provider secures the platform, the customer secures data, identities, and configuration), third-party and supply chain risk, data classification and privacy obligations, incident response, and emerging technology such as AI and operational technology.
Traps
Questions routinely confuse RTO with RPO, or assume a cloud provider inherits the customer's compliance obligations. Another frequent trap is prescribing a preventive control when the scenario describes an event already occurring and undetected: detection requires logging, monitoring, or alerting. Encryption protects confidentiality; it does not ensure availability or integrity of a corrupted backup. Also beware of "compliance equals security" reasoning: passing an audit is not proof that controls operate effectively.
Rule of thumb
Name the risk first, then the control type. If the concern is discovering something in progress, the answer is detective (monitoring, logs, IDS); if it is stopping it, preventive (access control, segmentation, patching).
Worked example. A trading system must resume within four hours and lose no more than fifteen minutes of transactions, so RTO is four hours and RPO is fifteen minutes; the replication design and backup frequency follow from those two numbers, not the reverse.