Identity Security Control Types

cybersecurity analyst

a senior position within an organization’s security team with direct responsibility for protecting sensitive information and preventing unauthorized access to electronic data and the systems that protect it

role functions:

-implementing and configuring security controls

-working in a SOC or CSIRT

-auditing security processes and procedures

-conducting risk assessments, vulnerability assessments, and penetration tests

-maintaining up to date threat intelligence

Security Operations Center(SOC)

a location where security professionals monitor and protect critical information assets in an organization

security control

mitigates vulnerabilities and risk to ensure the confidentiality, integrity, availability, nonrepudiation, and authentication of data

technical(logical) controls

a category of security control that is implemented as a system(hardware, software, or firmware)

operational controls

a category of security control that is implemented primarily by people rather than systems

managerial controls

a category of security control that provides oversight of the information system

preventative control

a control that acts to eliminate or reduce the likelihood that an attack can succeed

detective control

a control that may not prevent or deter access, but will identify and record any attempted or successful intrusion

corrective control

a control that acts to eliminate or reduce the impact of an intrusion event

physical control

a type of security control that acts against in person intrusion attempts

deterrent control

a type of security control that discourages intrusion attempts

compensating control

a type of security control that acts as a substitute for a principal control

responsive control

system that actively monitors for potential vulnerabilities or attacks, and then takes action to mitgate them before they can cause damage