4.1 Introduction; 4.2 Perception and reality; 4.3 The ‘What’ of security analysis—the domain of security from core to periphery; 4.4 The ‘Who’ of security analysis; 4.5 Management: the ‘How’ of security; 4.6 Conclusion; 4.7 References