And you should be looking at your security systems as a way to conduct risk management. Therefore, it's useful to look at how businesses manage risk. First, they quantify risk, assessing the probability and consequences of an adverse event. They then determine the liability, or who gets hurt if the event occurs. The second step is to take remedial measures.
Businesses typically mitigate risk by reducing the probability, the consequences or both.
They also assign or disclaim liability. Businesses often purchase insurance that indemnifies their organization and people. Network security often addresses only the prevention part of this equation. To succeed over the long term, security must help organizations manage risk by allowing them to assign and manage liability more clearly. Likewise, authorization systems allow you to manage liability more clearly.