Security

Protection proportional to risk and context.

Security is not a control added at the end. It is built into identity, permissions, data, development, infrastructure and operations.

Principles

• Least privilege
• Separation of duties
• Secrets kept out of source code
• Encryption in transit
• Updates and vulnerability management
• Traceability
• Backups and tested restoration
• Incident response
• Privacy by design

Risk management

No connected system can promise zero risk. The objective is to reduce exposure, detect problems and restore operations.