An Intro to Security Controls!
Security controls are measures that help protect data and IT infrastructure from cyber threats. They can be classified in different ways, depending on their type and its function.
- Based on Type: Security controls can be physical, technical, or administrative.
– Physical controls are tangible objects that prevent or detect unauthorized access to physical areas, systems, or assets. For example, locks, guards, cameras, etc.
– Technical controls are hardware or software mechanisms that protect assets. For example, firewalls, antivirus software, encryption, etc.
– Administrative controls are policies, procedures, or guidelines that define security practices. For example, employee training, data classification, auditing, etc.
- Based on Function: Security controls can be preventive, detective, deterrent or corrective.
– Preventive controls are designed to avoid or reduce the likelihood of cyberattacks. For example, strong passwords, access control lists, etc.
– Detective controls are designed to identify or monitor cyberattacks. For example, intrusion detection systems, log analysis, etc.
– Deterrent controls are security measures that warns or discourages potential attackers from attempting to harm a system or data. For example, a sign that says “No Entry” or “Beware of Camera” can be a deterrent control.
– Corrective controls are designed to restore or mitigate the impact of cyberattacks. For example, backup and recovery, incident response, etc.
Security controls are not chosen or implemented randomly. They are based on the organization’s risk management process, security strategy, and control objectives. Security controls should also follow certain frameworks or standards, such as NIST, CIS, ISO, etc. These frameworks or standards provide best practices and guidelines for developing and implementing security controls in different domains and scenarios.
I hope you find this post useful and informative. Please feel free to share your thoughts and feedback in the comments. Stay tuned for more posts on cybersecurity, risk and compliance in the coming days.
