Security controls

This article may be confusing or unclear to readers. Please help clarify the article. There might be a discussion about this on the talk page. (January 2012) (Learn how and when to remove this message)

Security controls, security measures or countermeasurs are safeguards to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets. In the field of information security, such controls protect the confidentiality, integrity and availability of information.

Systems of controls can be referred to as frameworks or standards. Frameworks can enable an organization to manage security controls across different types of assets with consistency.

Security controls reduce the likelihood of any impacts of security incidents and protect the CIA triad for systems and data. Protecting the CIA triad helps organizations meet their responsibilities through consistent risk management of systems, assets, data, networks and physical infrastructures.

The definition of countermeasure is given in IETF RFC 2828 and CNSS Instruction No. 4009 dated 26 April 2010 by the Committee on National Security Systems. According to the Glossary by InfosecToday, the meaning of countermeasure is:

The deployment of a set of security services to protect against a security threat.

Overview

A resource (both physical or logical) can have one or more vulnerabilities that can be exploited by a threat agent in a threat action. The result can potentially compromise the confidentiality, integrity or availability properties of these resources (potentially different than the vulnerable one) of the organization and other involved parties (customers, suppliers).
The so-called CIA triad is the basis of information security.

The attack can be active when it attempts to alter system resources or affect their operation: so it compromises integrity or availability. A "passive attack" attempts to learn or make use of information from the system but does not affect system resources, compromising confidentiality.

A threat is a potential for violation of security, which exists when there is a circumstance, capability, action, or event that could breach security and cause harm. That is, a threat is a possible danger enabling the exploitation of a vulnerability. A threat can be either "intentional" (i.e., intelligent; e.g., an individual cracker or a criminal organization) or "accidental" (e.g., the possibility of a computer malfunctioning, or the possibility of an "act of God" such as an earthquake, fire, or tornado).

A set of policies concerned with information security management, the information security management systems (ISMS), has been developed to manage, according to risk management principles, the countermeasures in order to accomplish to a security strategy set up following rules and regulations applicable in a country.

Types of security controls

Security controls can be classified by various criteria. One approach is to classify controls by how/when/where they act relative to a security breach, sometimes termed as control types:

• Preventive controls are intended to prevent an incident from occurring e.g. by locking out unauthorized intruders; Sometimes known as firewalls or locked server rooms that restrict physical entry
• Detective controls are intended to identify, characterize, and log an incident e.g. isolating suspicious behavior from a malicious actor on a network or using network monitoring tolls to flag suspicious activity.;
• Compensating controls mitigate ongoing damages of an active incident, e.g. shutting down a system upon detecting malware
• After the event, corrective controls are intended to restore damage caused by the incident e.g. by recovering the organization to normal working status as efficiently as possible.

Security controls can also be classified according to the implementation of the control (sometimes termed control categories), for example:

• Physical controls - includes tangible items such as fences, doors, locks, CCTV systems and fire extinguishers;
• Procedural or administrative controls - e.g. incident response processes, management oversight, security awareness and training.
• Technical or logical controls - e.g. user authentication (login) and logical access controls, antivirus software, firewalls;
• Legal and regulatory or compliance controls - includes privacy laws, policies, regulations and clauses that help organizations handle and protect (e.g. HIPAA, GDPR).

These classifications help organizations build a well-designed, multi-layered defense strategy in which different layers help control and prevent threats as they occur.

Physical controls

If a potential malicious actor has physical access to a computer system, they have a greater chance of inflicting harm upon it.

Control effectiveness and lifecycle

Security controls include both technical controls (such as access management and firewalls) and administrative controls (including policies and procedures).

An effective controls testing and verification process allows:

• Identifying safeguards that are protecting confidentiality, integrity, and availability of assets.

• Detailed overview of any security posture of the service.

• Contribution to any mitigation plans that may be prioritized for reducing risks arising because of any weaknesses or failures of controls

Steps for assessment:

Document security control implementation: securing infrastructure, configuring components, identifying & access management, security polices

Monitor & verify security controls: Usually manual or automated testing and it tests penetration, reviewing logs, vulnerability scanning, any surveys and interviews with staff, and more.

Reporting test results: Generating reports, metrics, trends

Controls are part of a risk treatment strategy applied after risk assessment and designing, building, operating, and changing them is a part of the lifecycle.

Purpose in organizations

University IT policy states that “Using a set of standardized controls allows IT security to ensure all University and Medical Center areas are protected from threats.”

Controls in four basic categories: Computer Controls, Data Protection, Network Protections, User Authentication

Computer Controls: Organizations may implement email protection, endpoint detection & response, centralized patch management, and domain membership.

Data Protection: For protecting data organizations may equip full disk encryption and media destruction

Network Protection: Protecting the network is important for keeping information safe from unwanted users. Organizations may use flow monitoring, logging network & system activity, network border protections and prohibit firewall to be bypassed to reduce an attack.

User Authentication: Organizations may use two-factor authentication, may force users to change their passwords annually, have only authorized account management, and use a Local Admin Password Solution (LAPS).

Information security standards and control frameworks

The ISO/IEC 27000 series standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. The most recent version, ISO/IEC 27001;2022, released in October 2022, specifies 93 controls; some of the most well-known standards are outlined below.

Telecommunications

This section needs expansion. You can help by adding missing information. (July 2024)

In telecommunications, security controls are defined as security services as part of the OSI model. These documents specify mechanisms such as authentication, access control, and data confidentiality to protect any network communications:

• ITU-T X.800 Recommendation.
• ISO ISO 7498-2

These are technically aligned. This model is widely recognized.

Data liability (legal, regulatory, compliance)

The intersection of security risk and laws that set standards of care is where data liability is defined. A handful of databases are emerging to help risk managers research laws that define liability at the country, province/state, and local levels. In these control sets, compliance with relevant laws is the actual risk mitigator.

• Perkins Coie Security Breach Notification Chart: A set of articles (one per state) that define data breach notification requirements among US states.
• NCSL Security Breach Notification Laws: A list of US state statutes that define data breach notification requirements.
• ts jurisdiction: A commercial cybersecurity research platform with coverage of 380+ US State & Federal laws that impact cybersecurity before and after a breach. ts jurisdiction also maps to the NIST Cybersecurity Framework.

Business control frameworks

This section is in list format but may read better as prose. You can help by converting this section, if appropriate. Editing help is available. (July 2024)

There is a wide range of frameworks and standards looking at internal business and inter-business controls, including:

• SSAE 16
• ISAE 3402
• Payment Card Industry Data Security Standard
• Health Insurance Portability and Accountability Act
• COBIT 4/5
• CIS Top-20
• NIST Cybersecurity Framework

See also

References

External links

• NIST SP 800-53 Revision 4
• DoD Instruction 8500.2
• FISMApedia Terms