22.3.1. Security Controls

22.3 Governance Risk and Compliance

security control

anything you put in place to reduce risk.

It's like a safeguard that helps stop bad things from happening to your valuable stuff (like your data or devices).

Technical Security Controls

(implemented by technology, e.g. firewalls, antivirus)

Administrative Security Controls

(policies, procedures, and guidelines established by management to govern how an organization manages risk and maintains security.

Physical Security Controls

(hardware or environmental, e.g. locks, badge access)

Preventive Control Functions

These controls stop an attack or incident before it happens. They are proactive measures.

• Examples: Security awareness training, firewalls, and strong account policies.

Detective Control Functions

find out if an attack has happened or is in progress. They identify an incident.

• Examples: Reviewing system logs, video surveillance, and Security Information and Event Management (SIEM) systems.

Corrective Control Functions

fix issues after an attack occurs. Their purpose is to minimize damage and restore systems.

• Examples: Data backups for recovery, system recovery procedures, and Intrusion Prevention Systems (IPS) that block detected threats.

Deterrent Control Functions

discourage potential attackers from even trying. They aim to make the target seem too risky or difficult.

• Examples: Visible warning signs, security guards, and physical cable locks on equipment.

Compensating Control Functions

fill a gap when a primary control isn't feasible. They provide an alternative way to maintain security.

• Examples: Using Time-Based One-Time Passwords (TOTP) when a more preferred authentication method isn't possible, or using strong encryption for data when physical security is limited.

Risk

Likelihood that a threat exploits a vulnerability

Threat

Something that could harm CIA (confidentiality, integrity, availability)

Vulnerability

Weakness that can be exploited

Security Incident

A breach of policy or system that harms CIA

Risk Assessment

Identify assets & what risks could affect them

Vulnerability Assessment

Use scanners/tools to find flaws