OB 1.1 SEC CONTROLS

Technical security controls,

known as

logical security controls, are mechanisms

implemented in hardware, software, or

firmware that automate the process of

preventing, detecting, and responding to

security threats.

Managerial security controls

administrative controls, are the policies,

procedures, and guidelines that govern the

behavior of people within an organization

and the operation of the IT systems

what do tech security controls include

◦ Access Control Mechanisms

◦ Firewalls

◦ Intrusion Detection Systems (IDS) and

Intrusion Prevention Systems (IPS)

◦ Encryption

◦ Antivirus and Antimalware Software

◦ Virtual Private Networks (VPN)

what do Managerial security controls include

◦ Security Policies and Procedures

◦ Risk Management

◦ Incident Response and Recovery Plans

◦ Business Continuity and Disaster Recovery

Planning

Operational security controls

daily methods and procedures that are

implemented by an organization to ensure

and maintain the security of its information

and assets. Done by people in the organization.

what do

Operational security controls include

◦ Security Awareness Training

◦ Physical media protection

Physical security controls

protect

hardware and facilities that house the

systems, networks, and data.

These controls are designed to prevent

unauthorized access, damage, and

interference to the organization's physical

resources.

what do Physical security controls include

◦ Lighting

◦ Signs

◦ fences

◦ Security guards

◦ Cameras

Preventive controls

Attempts to stop a security incident from

occurring.

what do Preventive controls include

IPS, firewalls, encryption, access controls

Detective controls

Attempts to detect events that resulted in a

security incident

Corrective controls

Attempts to remediate an incident that has

occurred.

what do detective controls include

IDS, SIEM, video surveillance, motion

detection

what do corrective controls include

UPS, restoring backups, incident

response procedures

Deterrent controls

Attempts to discourage a threat

Directive controls

Provides directions on how to systems.

Compensating controls

Provides alternate controls when the primary

control may not be sufficient

what do

Deterrent controls include

Guard dogs, Cameras, barbed wire

what do

directive controls include

Polices, Procedures

what do Compensating controls include

Segregation of duties

Defense in Depth

information assurance concept

where multiple layers of security controls

(defensive mechanisms) are placed

throughout an information technology (IT)

system.

Utilizing multiple controls in a layered

manner to protect information.