First, they quantify risk, assessing the probability and consequences of an adverse event. They then determine the liability, or who gets hurt if the event occurs. The second step is to take remedial measures. Businesses typically mitigate risk by reducing the probability, the consequences or both. They also assign or disclaim liability.
Businesses often purchase insurance that indemnifies their organization and people.
Network security often addresses only the prevention part of this equation. To succeed over the long term, security must help organizations manage risk by allowing them to assign and manage liability more clearly. Likewise, authorization systems allow you to manage liability more clearly. Through policies that you link to business process, you can explicitly define what people can do, and when they can do it. You can also define the policy conditions under which they're operating, assigning, sharing or disclaiming any liability associated with their actions.