Explain the difference between deterrence and mitigation in security design.

• A. Deterrence discourages attacks through rules, penalties, or visible defenses; mitigation reduces impact through controls and response capabilities.
• B. Deterrence is only about cameras; mitigation is only about barriers
• C. Deterrence eliminates threats; mitigation avoids risks by ignoring them
• D. Deterrence fixes vulnerabilities; mitigation increases risk

Answer: (A)

Deterrence and mitigation are two ways to handle security, aimed at different points in the risk process. Deterrence tries to prevent an attack before it starts by making it unattractive or risky for the offender: clear rules, penalties, and visible defenses signal that taking a chance will be difficult or costly. The idea is to persuade would-be attackers that the effort isn’t worth it.

Mitigation, by contrast, accepts that threats can occur and focuses on reducing what happens after an incident: strong controls, redundancy, detection, and a speedy, effective response so the impact is minimized and recovery is quick. It’s about limiting damage and keeping operations going even when a breach or incident happens.

So the best description is that deterrence discourages attacks through sanctions and visible defenses, while mitigation reduces impact through protective measures and response capabilities. The other notions—like thinking deterrence eliminates threats or that mitigation ignores risk, or that deterrence is limited to cameras or that mitigation merely increases risk—don’t fit the true roles of these concepts.