INTRODUCTION

This book was written to enlighten security officials about security information management, which includes the collection and analysis of information on security incidents, threats and vulnerabilities and the implementation of security risk control measures. The security industry operates within a diverse and multi-disciplinary knowledge base, with security risk management being a fundamental knowledge domain within security. Over the past decade, the concept of security risk management as a formal discipline has emerged throughout the private and government sectors of security. Security risk management is now a well-established discipline, with its own body of knowledge. The standards and compliance requirements for risk management only considers security risk management and not security information management. In security risk management, security risk assessment is carried out to identify areas that need security intervention. The security risk management framework currently used by the security industry provides for security risk analysis. This does not include the day-to-day collection of security information on security incidents, threats and vulnerabilities for the purpose of reducing crime, increasing detection rates and preventing losses. In this final chapter, attention will be given to a brief summary of the kinds of security information that was discussed in this book.

SECURITY INCIDENTS, THREATS AND VULNERABILITIES

Security incidents occur because of security breaches, breaches of discipline by security officers, and poor implementation of existing security policies and procedures. Threat is considered as the consequence of the incident, which at the time the incident was taking place, may have affected people, information or assets. In the security context, a threat may be defined as an adversary, being the sum of intent and capability (Smith and Brooks, 2013). Vulnerability on the other hand gives exposure for an incident to occur, causing physical and emotional hurt, being open to attack, or lacking resilience (Smith and Brooks, 2013). It was found that in many organisations/companies security incidents are managed without any strategic direction and infrastructure.