Security Control Types (OBJ 1.1)

Types of Security Controls

Overview of Security Controls

  • The importance of varied security controls:
    • Similar to how a skilled doctor uses different treatments based on an illness, security professionals must select security controls based on specific threats and vulnerabilities.
    • Understanding the nature, details, and appropriate application of each control is crucial for effective organizational protection.

Six Basic Types of Security Controls

  1. Preventative Controls

    • Definition: Proactive measures implemented to thwart potential security threats or breaches before they occur.
    • Purpose: To fortify systems against incidents.
    • Example:
      • A firewall acts as a preventative control by filtering incoming and outgoing traffic, blocking potentially harmful data packets before they can penetrate the network.

  2. Deterrent Controls

    • Definition: Controls designed to discourage potential attackers by making their targets less appealing or more difficult to approach.
    • Purpose: To create a perceived risk for attackers, making them think twice about proceeding with an attack.
    • Example:
      • Home burglar alarm systems with visible signs or placards.
      • Signage like "This property is monitored" communicates to potential intruders that surveillance is in place, increasing the perceived risk of apprehension.
      • Website warning banners about monitoring serve a similar purpose, discouraging illicit activities.

  3. Detective Controls

    • Definition: Controls that monitor and alert organizations to malicious activities as they happen or shortly thereafter.
    • Purpose: To detect incidents and notify the appropriate personnel for response and investigation.
    • Example:
      • Security cameras in residential settings serve as detective controls.
      • In the context of network security, an Intrusion Detection System (IDS) scans traffic for suspicious activity and notifies administrators of any detected anomalies (e.g., unexpected data spikes).

  4. Corrective Controls

    • Definition: Controls used after a threat has been detected to mitigate damages and restore systems.
    • Purpose: To repair and recover systems affected by incidents.
    • Example:
      • Antivirus software can act as both a detective control (detecting malware) and a corrective control (quarantining and removing it).
      • The distinction lies in the action taken: detection versus actual mitigation and cleanup.

  5. Compensating Controls

    • Definition: Alternative measures implemented when primary security controls are not feasible or effective.
    • Purpose: To ensure protection remains intact despite the absence of ideal controls.
    • Example:
      • An organization using a legacy system unable to support WPA3 encryption may implement WPA2 and employ a VPN to increase security.
      • This compensating control adds an additional layer of protection against vulnerabilities associated with WPA2.

  6. Directive Controls

    • Definition: Controls that guide, inform, or mandate actions within an organization.
    • Purpose: To set organizational policies and standards of behavior.
    • Example:
      • An Acceptable Use Policy (AUP) is a directive control providing guidelines on how employees should use company IT assets.

Interconnection of Control Types

  • Effective security management relies on selecting the right combination of controls across various categories:
    • Preventative controls build a strong foundation to minimize risks.
    • Deterrent controls act to dissuade threats before they manifest.
    • Detective controls monitor for incidents, ensuring awareness and response capability.
    • Corrective controls react to and remediate any breaches when they occur.
    • Compensating controls provide alternatives when the primary controls fail.
    • Directive controls offer guidance for operational effectiveness and policy adherence.
  • Understanding the unique roles of these controls contributes to crafting balanced and robust security strategies, ultimately maintaining the security and resilience of systems and networks.