Security Controls
There are many different categories and types of security to consider for. We are protecting different kinds of assets like Data, Physical Property and computer systems.
Results we expect from these security controls: Prevention of security breakdown events. Minimize the impact or limit the damages.
Security Control Categories:
Technical Controls - These are controls that we implement using some type of technical systems. Create policies and regulations over what operations and functions you want to occur within the systems (Operating systems control). Like enforce firewalls and use anti-virus.
Managerial Controls - Create policies to administer controls associated with how to keep their system and data safe. These can be seen in standard operating procedures.
Operational Controls - Instead of using computer systems we use people instead. Security guards, awareness programs.
Physical Controls - As name states it defines controls that limits anyone's access to a building, room or a device. Ex: Fences, Locks, Badge Readers, Guard shacks etc.
Security Control types:
Preventive Block access to a resource (You shall not pass)
Deterrent Discourage an intrusion attempt. (Does not directly prevent access kind of a warning)
Detective Identify and log an intrusion attempt. (This may not prevent the intrusion.)
Corrective Apply a control after an event has detected. It tries to reverse the impact of an event or continue operating with minimal downtime.
Compensating In event of security breach sometimes we might not have the resource or preventive measures to take care of it. So, we control using other means. (Maybe temporary)
Directive This control type directs someone how to be more secure than less secure. (Do this please!)
| Control Categories | Control Types | |||||
| Preventive | Deterrent | Detective | Corrective | Compensating | Directive | |
| Technical | Firewall | Splash Screen | System Logs | Restore using backups | Block instead of patch | File storage policies |
| Managerial | On-boarding Policy | Threat of demotion | Review log-in reports | Policies for reporting issues | Separation of duties | Compliance Policies |
| Operational | Guard Shack | Reception Desk | Property Patrols | Contact authorities | Require multiple security staff | Security policy training |
| Physical | Door Lock | Warning Signs | Motion Detectors | Fire extinguisher | Power generator | Sign: Authorized personnel Only |
These are few of the examples for such security controls and types. As new security controls evolve new types or categories can be seen.