Developing effective security controls is a balance between: