Technical Protection Measures in Information Security Systems in Organizations

Modern organizations rely on information assets, which form the foundation for all other assets and are among the most vulnerable to attacks.This article proposes a lightweight and traceable procedure for the preliminary selection of security measures.A simplified selection method is presented, linking three elements that are typically considered separately: organizational roles and communication flows, data states (at rest, in motion, or in use), and available technical controls.Sensitive data are identified in relation to roles and communication channels; threats are mapped to data states; and each potential control mechanism is characterized by just two relative parameters: effectiveness and cost.A multiplicative residual risk model and a cost-effectiveness ratio are used to rank the controls.This renders the calculations transparent and reproducible, without requiring the detailed quantitative data that most organizations do not maintain.An illustrative example, involving six widely used controls, demonstrates a reduction in residual risk from 100% to 31.8%.The point of diminishing returns is also identified: the four primary controls deliver approximately 90% of the achievable risk reduction at roughly half the total cost.The same approach is applied to compare traditional controls with innovative trends.