Security Controls Overview

Security Controls

• Security controls help protect the organization’s assets and data
• Controls act as a “defense-in-depth” approach
• Security controls help ensure CIA triad: Confidentiality, Integrity, and Availability

Categories of Security Controls

• There are four main categories of controls:
  • Technical: Tools and technologies like firewalls, encryption, and access controls
  • Managerial: Administrative and policy-based measures like creating security policies and risk assessments
  • Operational: Day-to-day practices and procedures, like user account management
  • Physical: Security measures for physical premises and assets, like access control systems and surveillance cameras

Hierarchy of Security Controls

• Security controls have a top-down hierarchy
  • Managerial controls set high-level policies and frameworks
  • Operational controls implement the policies and procedures defined by managerial controls
  • Technical controls are the actual implementation using tools and technologies
  • Physical controls support the other control categories

Managerial Controls

• Purpose: Guide and manage the organization's overall security program
• Responsibilities:
  • Setting security policies
  • Defining roles and responsibilities
  • Ensuring compliance with regulations and industry standards
• Examples:
  • Security policies and procedures
  • Risk assessments and risk management processes
  • Security awareness training for employees
  • Incident response and management plans
  • Security audits and assessments
  • Security governance and compliance frameworks

Operational Controls

• Purpose: Ensure effective implementation of security policies and technical controls
• Responsibilities:
  • Ongoing management and operations of security systems and processes
  • Supervising teams’ adherence to security policies
• Examples:
  • User account management and provisioning
  • Security monitoring and incident detection
  • Backup and recovery procedures
  • Change management processes
  • Physical access control to data centers or comm’s closets
  • Security log reviews and analysis
  • Patch management and system maintenance program

Technical Controls

• Purpose: Employ technologies and tools to protect systems and data
• Examples:
  • Data encryption (at rest and in transit)
  • Firewalls
  • Intrusion Detection and Prevention Systems (IDS/IPS)
  • Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR)
  • Data loss prevention (DLP)
  • Security Information and Event Management (SIEM)
  • Anti-virus (AV) software
  • Mobile device management (MDM)
  • Virtual Private Networks (VPN)
  • Log analysis
  • Incident response processes
  • Network segmentation and isolation
  • Firewall configurations
  • Biometric authentication systems
  • Security patches and software updates

Physical Controls

• Purpose: Protect the organization's physical premises and assets
• Examples:
  • Access control systems (biometric readers, scanners)
  • Surveillance cameras
  • Security guards
  • Fencing and barriers
  • Intrusion detection systems for physical facilities
  • Secure storage for documents and equipment
  • Shred policies
  • Data destruction policies and equipment
  • Environmental controls (fire suppression systems, climate control)

Control Types

Preventative Controls

• Purpose: Proactively reduce the likelihood of security incidents
• Examples:
  • Firewalls
  • Access control systems (ACLs)
  • Encryption
  • Strong authentication
  • Patching systems before an incident occurs

Detective Controls

• Purpose: Identify security incidents after they have occurred
• Examples:
  • Log analysis
  • Security audits
  • Intrusion detection systems (IDS)
  • Security Information and Event Management (SIEM)

Corrective Controls

• Purpose: Respond to and correct security incidents and breaches
• Examples:
  • Incident response plans
  • Patch management
  • Data recovery procedures
  • Backups

Compensating Controls

• Purpose: Provide alternative or additional security measures when primary controls are not feasible or insufficient
• Examples:
  • End-of-life or end-of-service systems
  • Implementing multiple layers of security to address vulnerabilities
  • Multi-factor authentication as a backup for forgotten usernames and passwords
  • Implementing a host-based firewall on a legacy server that cannot be upgraded

Deterrent Controls

• Deterrent controls discourage attackers and unauthorized individuals from breaching security, but don't necessarily prevent access.
• Examples include:
  • Warning signs
  • Security cameras
  • Intrusion detection systems

Directive Controls

• Directive controls provide guidance on security policies, procedures, and best practices.
• Examples include:
  • Security policies
  • Security awareness training
  • Security guidelines for employees