1.1 - Security Controls

Security Controls

  • Security risks are out there, different categories and types

  • Assets also varied

    • Data, physical property, computer systems

  • Prevent security events, minimize impact and limit damage

Technical Controls

  • Controls implemented using systems

  • Operating system (OS) controls

  • Firewalls, anti-virus

Managerial Controls

  • Administrative controls associated with security design and implementation

  • Security policies, standard operating procedures

Operational Controls

  • Controls implanted by people instead of systems

  • Security guards, awareness programs

Physical Controls

  • Limit physical access

  • Guard shack

  • Fences, locks

  • Badge readers

Preventive Control Types

  • Preventive

    • Block access to a resource

  • Prevent access

    • Firewall rules

    • Follow security policy

    • Guard shack checks all identification

    • Enable door locks

Deterrent Control Types

  • Deterrent

    • Discourage an intrusion attempt

    • Does not directly prevent access

  • Make an attacker think twice

    • Application splash screens

    • Threat of demotion

    • Front reception desk

    • Posted warning signs

Detective Control Types

  • Detective

    • Identify and log intrusion attempt

    • May not prevent access

  • Find the issue

    • Collect and review system logs

    • Review login reports

    • Regularly patrol the property

    • Enable motion detectors

Corrective Control Types

  • Corrective

    • Apply a control after an event has been detected

    • Reverse the impact of an event

    • Continue operating with minimal downtime

  • Correct the problem

    • Restoring the backups can mitigate a ransomware infection

    • Create policies for reporting security issues

    • Contact law enforcement to manage criminal activity

    • Use a fire extinguisher

Compensating Control Types

  • Compensating

    • Control using other means

    • Existing controls aren’t sufficient

    • May be temporary

  • Prevent the exploitation of weakness

    • Firewall blocks a specific application instead of patching the app

    • Implement a separation of duties

    • Require simultaneous guard duties

    • Generator used after power outage

Directive Control Types

  • Directive

    • Direct a subject towards security compliance

    • A relatively weak security control

  • Do this

    • Store all sensitive files in a protected folder

    • Create control policies and procedures

    • Train users on proper policy

    • Post a sign for “Authorized Personal Only”

Managing Security Controls

  • Not inclusive

    • Many categories of control

    • Some organizations will combine types

  • There are multiple security controls for each category and type

    • Some security controls may exist in multiple types or categories

    • New security controls are created as systems and processes evolve

    • Your organizations may use very different controls