Which of the following statements is true?

a. The concept of defense-in-depth reflects the fact that security involves the use of a few sophisticated technical controls.

b. Information security is necessary for protecting confidentiality, privacy, integrity of processing, and availability of information resources.

c. The time-based model of security can be expressed in the following formula:

P < D+ C

d. Information security is primarily an IT issue, not a managerial concern.