Front cover - IBM Redbooks

2.1.2 Risk mitigation
46 Lotus Security Handbook
With your security policy in hand, which provides you with an understanding of
the security threats and risks involved, you will have an idea of the measures you
must adopt to secure your sensitive information.
At this point, you are ready to design your computer security architecture and
implement the computer security services.
We are now ready to move on to risk mitigation. This is the single most
important objective in any work that involves the implementation of security. By
mitigation, we mean anything that reduces something of a negative nature. In
this case, what we wish to reduce is the risks faced by an IT system as we have
defined it.
The kind of organization in which security is being implemented is irrelevant to
this discussion since all organizations and their IT systems face some form of
risk, and all should strive for the maximum amount of security possible. (It is true
that some organizations are more at risk than others, but we leave that
consideration to later in this book.)
In order for risk mitigation (and the implementation of the security architecture) to
be successful, it is imperative that the overall enterprise security policy be the
responsibility of the top managers of the organization. They have to decide
where the major security risks for their type of business lie and how to proceed
from there.