I work for the IPSC of the JRC of the EC. Ideally all those working here should know the difference between Security and Protection; after all both concepts feature in the name of the institute that provides their bread. However, I really think that of the hundreds of employees in IPSC probably relatively few would be able to define it precicely. It could even be tempting for some to argue that there is no difference between the two and that, in fact, the name of the institute was probably put together by some clueless politician. This has nothing to do with JRC and IPSC in particular and everything to do with how people in general often let similar or closely related concepts merge into each other - important distinctions being lost in the process.

The fact is however that there is a difference between the two, however subtle and context vulnerable. In a nutshell, protection implies action while security implies goals. That is, security is expressed as a set of "oughts" (comprising what is usually referred to as a "security policy") that are enforced by a set of appropriate protection mechanisms and activities.