Security Controls Overview

Security Controls

• Security controls are safeguards or countermeasures that address and minimize the loss or unavailability of services, apps, or data due to security vulnerabilities.
• Safeguards are proactive and aim to reduce the likelihood of security incidents.
• Countermeasures are reactive and are deployed to reduce the impact of a security incident after it occurs.
• Control Types include:
  • Deterrent: Discourages violation of security policies.
  • Preventive: Thwarts or stops unauthorized activities.
  • Detective: Discovers or detects unwanted or unauthorized activity.
  • Compensating: Aids in enforcing security policies when other controls are not sufficient.
  • Corrective: Modifies the environment to return systems to normal after an incident.
  • Directive: Imposes a specific action after authentication.
• Accountability establishes proof of action, including the identity of the user who performed it. This is achieved through authentication, identification, and auditing.
• Auditing Logs and Audit Trails record events and user activities.

Authorization Models

• Non-Discretionary Access Control: Enforces system-wide restrictions, overriding object-specific access control. An example is Role-Based Access Control (RBAC).
• Discretionary Access Control (DAC): Grants or denies access based on the owner of an object. The owner can grant access to any other subject. An example is New Technology File System (NTFS).
• Role-Based Access Control (RBAC): Assigns privileges to roles instead of users, associating user accounts with specific roles. This is typically map to job roles.
• Rule Based Access Control (RBAC): Applies global rules to all subjects. Examples include firewall rules that allow or block traffic equally to all users.
• Mandatory Access Control (MAC): Defines access based on predefined labels assigned to objects and subjects. The system determines access based on these labels. This model commonly seen in military security.
• Attribute-Based Access Control: Restricts access based on attributes associated with the account, such as department, location, or functional designation.

Change Management

• Change Management Processes are critical for ensuring system security and stability. They address business processes and technical implications, and require detailed documentation.
• Change Management addresses:
  • Approval Process: Ensures that proposed changes are reviewed and approved by management.
  • Ownership: Clearly defines responsibility for each change, designating a primary owner.
  • Stakeholder Analysis: Identifies and coordinates with all individuals and groups affected by the change.
  • Impact Analysis: Evaluates potential impacts, including side effects.
  • Testing: Validates the change in a test environment before production rollout.
  • Backout Plan: Outlines the process for reversing a change if it fails.
  • Maintenance Windows: Defines specific times for implementing changes, minimizing impact to the business.
• Technical Implications of change management include:
  • Allow Lists/Deny Lists: Firewall rules, application access lists, and Access Control Lists (ACLs) may need to be updated.
  • Restricted Activities: Certain activities, such as data updates during database replication, may need to be restricted.
  • Downtime: Changes may disrupt services, requiring careful planning to minimize impact.

Cryptographic Concepts

• Cryptographic Choices depend on specific use cases, such as:
  • Low-Power Devices: Frequently use ECC for encryption due to its small key size.
  • Low Latency: Employs specialized encryption hardware or accelerators for efficient encryption and decryption.
  • High Resiliency: Uses the most secure algorithms to prevent key compromise by attackers.
• Cryptography is used to support various security objectives:
  • Confidentiality: Encryption protects sensitive data, ensuring only authorized parties can access it.
  • Integrity: Ensures data has not been tampered with and communications are not altered in transit.
  • Obfuscation: Obscures data, making it unintelligible to unauthorized individuals.
  • Authentication: Verifies user identities and device authenticity.
  • Non-Repudiation: Prevents parties from denying their involvement in a transaction.

Cryptographic Concepts: Limitations

• Speed: Cryptography can impact system performance and resources.

• Key Management: Managing cryptographic keys is crucial for security.

• Algorithm Development: New cryptographic algorithms are constantly being developed.

• Hardware & Software Support: Compatibility between cryptographic algorithms, hardware, and software is essential.

• Blockchains:

  • Public vs. Private Ledgers: Public ledgers allow for more easily changing data, whereas data on a blockchain is immutable and cryptographically secured.
  • Validation: Blockchains uses consensus mechanisms (e.g., Proof-of-Work, Proof-of-Stake) to validate new data. Public ledgers rely on the integrity of a central authority.
  • Transparency: Blockchain transactions are typically pseudonymous for privacy, while public ledger transactions are fully transparent.

This quiz covers the fundamental concepts of security controls, including their types and purposes. Learn about safeguards, countermeasures, and the different control types used to enhance security. Test your knowledge on how these elements work together to protect systems and data.