1.0 Notes

1.1 - Security Controls

Security controls

reduce risk, prevent events, minimize impact, and limit damage to data, property, people, and systems.

Technical security controls

Which Security Control Categories?

are measures that are put in place to protect the confidentiality, integrity, and availability of a system or network. These controls can include firewalls, intrusion detection/prevention systems, encryption, and access controls.

systems and technology, such as firewalls, anti-malware, encryption, and operating-system settings.

Managerial security controls

Which Security Control Categories?

are measures that involve directing and overseeing the overall security of an organization. These controls can include risk assessments, security awareness training, incident response planning, and service acquisition.

governance, policies, standards, procedures, and risk decisions.

Operational security controls

Which Security Control Categories?

are measures that involve the day-to-day operations of an organization’s security. These controls can include backup and recovery procedures, configuration management, media protection, and log monitoring.

people and processes, such as guards, training, patrols, backups, and log review.

Physical security controls

Which Security Control Categories?

barriers and access controls, such as fences, locks, guard shacks, and badge readers.

Preventive

Which Control Types ?

blocks before an event;

Deterrent

Which Control Types ?

– Discourage an intrusion attempt

– Does not directly prevent access

• Make an attacker think twice

– Application splash screens

– Threat of demotion

– Front reception desk

– Posted warning signs

Detective

Which Control Types ?

Identifies/logs

• Find the issue

– Collect and review system logs

– Review login reports

– Regularly patrol the property

– Enable motion detectors

Corrective

Which Control Types ?

restores or limits impact after detection

– Reverse the impact of an event

– Continue operating with minimal downtime

• Correct the problem

– Restoring from backups can mitigate a ransomware

infection

– Create policies for reporting security issues

– Contact law enforcement to manage criminal activity

– Use a fire extinguisher

Compensating

Which Control Types ?

is an alternative control

– Control using other means

– Existing controls aren’t sufficient

– May be temporary

• Prevent the exploitation of a weakness

– Firewall blocks a specific application instead of

patching the app

– Implement a separation of duties

– Require simultaneous guard duties

– Generator used after power outage

Directive

Which Control Types ?

Tells people how to comply.

– Direct a subject towards security compliance

– A relatively weak security control

• Do this, please

– Store all sensitive files in a protected folder

– Create compliance policies and procedures

– Train users on proper security policy

– Post a sign for “Authorized Personnel Only”

Physical security controls

Control Type Examples:

• Preventive: Door lock

• Deterrent: Warning signs

• Detective: Motion detectors

• Corrective: Fire extinguisher

• Compensating: Power generator

• Directive: Sign: Authorized Personnel Only

Operational security controls

Control Type Examples:

• Preventive: Guard shack

• Deterrent: Reception desk

• Detective: Property patrols

• Corrective: Contact authorities

• Compensating: Require multiple security staff

• Directive: Security policy training

Technical security controls

Control Type Examples:

• Preventive: Firewall

• Deterrent: Splash screen

• Detective: System logs

• Corrective: Backup recovery

• Compensating: Block instead of patch

• Directive: File storage policies

Managerial security controls

Control Type Examples:

• Preventive: On-boarding policy

• Deterrent: Demotion

• Detective: Review login reports

• Corrective: Policies for reporting issues

• Compensating: Separation of duties

• Directive: Compliance policies