defensive measures utilized by IT and InfoSec communities to limit vulnerabilities and manage risks to an acceptable level