It is a good idea to view the security function as a police force or military organization.

• A. True
• B. False
• C. Sometimes
• D. Only in high-security contexts

Answer: (B)

Viewing security as a police force or military organization suggests a rigid, command-and-control approach focused on deterrence and punishment. In practice, effective security is a governance function that enables the business while managing risk. It relies on collaboration across departments, proportional controls, risk-based decision making, and a emphasis on resilience, detection, and rapid response rather than punitive enforcement alone. A militaristic mindset can erode user trust, stifle innovation, and overlook human factors and privacy considerations, which are essential to staying secure in real-world environments. The best model is to align security with business goals, use layered defenses, and treat it as an ongoing risk management and incident response effort, not a policing or military paradigm.