What's the term for risk ADDED by a security control?

There's inherent risk and residual risk, and a third term I can't remember. It's a term to describe risk that a security control adds by its inclusion. For example:

* A security tool that automatically isolates computers that fail health checks can impact availability, especially if there are false positives.
* A fire suppression system that eliminates oxygen presents a new danger to the people inside.
* Offsite backup storage presents new confidentiality risks in transit and at the new location.
* Cloud-based systems generally increase availability, but are dependent on an internet connection. Interruption of service will bring them down.




These are all tools that can be mitigated through configuration or other controls. But they are risks that wouldn't be there without the controls in place.

SOLVED: It's Secondary Risk. Primary Risk is what was in the original risk assessment, secondary risk is the risks that were added by the controls mitigating the primary risk. submitted by /u/skribsbb
[link] [comments]


http://dlvr.it/T9H727