When selecting countermeasures for risk mitigation, the security practitioner should consider:

As a threat increases in sophistication, the effectiveness of the countermeasures should remain unchanged

The same levels of countermeasure effectiveness and system performance are needed to address different threats

The effectiveness of individual countermeasures and the entire security system depends on the security department's capabilities

As a threat increases in sophistication, the effectiveness of the countermeasures must also increase, or the additional risk must be managed by some other means