Even the leading security experts in the world do not all agree on definitions and groupings. This is not a trivial matter when trying to establish good information security, but the fact is that terminology throughout the industry is not consistent. Often, organizations are describing technologies and processes that provide similar results, but the terminology confusion may cause apparent conflicts between potential guidelines, policies, and practices or various system design requirements . The solution is to adapt as well as possible to the various models and terminologies that best suit the particular activity. The definitions used in this document represent an attempt to be consistent with the industry's state of the practice.
Information security incurs direct and indirect costs .
Direct costs are incurred for purchasing, installing, and administering security measures. Additionally, security measures sometimes affect system performance, employee morale, or retraining requirements. Such indirect costs must be considered in addition to the basic cost of the control itself. Cost-effective security results when risk reduction is balanced with costs . The greater the value of information processed, or the more severe the consequences if something happens to that information, the greater the need for control measures to protect it.