Security controls

Risk mitigation strategies involve the security controls that address one or more risk areas. For example, preventative controls are designed and implemented to prevent a security violation from happening. Similarly, detective controls are designed and rolled out to detect a security violation; reactive and recovery controls assist in business continuity in the event of a disaster or disruptions to business processes.

This security violation can stem from either an inadvertent or malicious breach of a security policy. For example, a security policy may state that Non-Public Information (NPI) such as internal communications between board members or internal project information should not be exposed to general public. If an employee posts such kind of information in a public blog, or if he sends out such information to an external entity through e-mail, then this will constitute a security violation. Such an act by an employee may be inadvertent. However, if an employee...