Security Controls in IT Security

Introduction

• IT security involves preparing for various security risks.
• Attackers seek different ways to access systems.
• We protect data and physical systems, buildings, people, and organizational assets.
• Security controls can prevent events, minimize impact, or limit damage when breaches occur.

Categories of Security Controls

1. Technical Controls

• Implemented using technical systems.
• Example: Operating system policies and procedures, firewalls, antivirus software.

2. Managerial Controls

• Policies and procedures created by management.
• Example: Security policy documentation, standard operating procedures.

3. Operational Controls

• Implemented by people to maintain security.
• Example: Security guards, awareness programs, lunch and learns.

4. Physical Controls

• Limit physical access to buildings, rooms, or devices.
• Example: Guard shacks, fences, locks, badge readers.

Control Types and Categories

1. Preventive Controls

• Limit access to resources.
• Examples:
  • Firewall rules → Technical
  • Onboarding policies → Managerial
  • Guard shack ID checks → Operational
  • Door locks → Physical

2. Deterrent Controls

• Discourage or deter attacks.
• Examples:
  • Splash screens → Technical
  • Demotion threats → Managerial
  • Reception desk → Operational
  • Warning signs → Physical

3. Detective Controls

• Identify and warn about breaches.
• Examples:
  • System logs review → Technical
  • Reviewing login reports → Managerial
  • Property patrols → Operational
  • Motion detectors → Physical

4. Corrective Controls

• Occur after an event; minimize impact or allow continued operation.
• Examples:
  • Data recovery from backups → Technical
  • Policies for incident reporting → Managerial
  • Contacting authorities → Operational
  • Fire extinguishers → Physical

5. Compensating Controls

• Temporary measures when full resolution isn’t possible.
• Examples:
  • Firewall rules to block vulnerability exploits → Technical
  • Separation of duties → Managerial
  • Multiple security guards → Operational
  • Power generators → Physical

6. Directive Controls

• Direct actions for security (weaker control).
• Examples:
  • Storing sensitive info in encrypted folders → Technical
  • Compliance policy → Managerial
  • Security policy training → Operational
  • Authorized personnel only signs → Physical

Summary

• Various security controls and categories.
• Examples illustrate fitting controls into categories.
• Different organizations may use different controls.