Let's take a look at security controls,
the third part of this Security Principles for
Certified in Cybersecurity examination.
We started this course out looking at information security concepts
understanding what security was and then providing proper oversight
and governance for the security program,
including things like a security strategy and what we hope to accomplish,
our objectives.
A lot of this was influenced by risk.
What are the things that could go wrong?
We looked at risk from that negative perspective if something would
impact business operations in a negative way.
So therefore,
we're going to build out and address that risk in order to meet that
strategy through the deployment of security controls.
We know that we have risk, it's a part of business,
things can go wrong, but we then know we have the option to implement controls.
Those controls that we put in place, the controls we choose,
are justified by the risk we face.
We should not have a control where there is no known risk nor
should we have a significant risk and decide nah,
we're not going to bother putting in controls.
No, risk justifies the choice and deployment of controls,
but just as that justification is there,
those controls are there in order to address and mitigate the risk.
If the control is not accomplishing that task of mitigating the risk,
it's probably the wrong control actually.
This is part of risk treatment or sometimes called risk response.
So we look at, for example,
this diagram we've examined before where we had a threat actor,
some type of a threat source that exploited a vulnerability and that
exploit then could come with a certain level of likelihood.
Did it happen?
That vulnerability allowed now some type of impact on our asset,
our business process, our building, whatever it happens to be.
That is the determination of our level of risk.
What is the likelihood and what is the impact of this damage should it happen?
From this,
we know that we have recommendations of what we could do about this risk.
That was the selection of a control or multiple controls.
When I select a control,
the purpose of the control is to try to mitigate the impact,
make it less damaging, or to reduce the likelihood of this happening.
So a control will usually address impact or likelihood,
but it's rarely going to be able to really address the threat.
The threat source will always be there,
but we can make it more difficult for that threat to be
effective and to be able to damage our systems.
We can see here, for example,
that if I wear my seatbelt and there is a car accident,
hopefully there is less, should we say, personal injury.
The seatbelt might save my life.
In other words, the impact was reduced.
If I have good tires on my car,
it might reduce the likelihood of having that accident.
So these are two different ways we can see that
controls will reduce a known risk.
There are three main types of controls, but in order to make it confusing,
we always use two terms for each one, administrative controls,
or sometimes called managerial controls,
technical, or sometimes known as logical controls,
and physical, also known as environmental controls.
These are our three main types of controls.
When we put controls in place, they could either be proactive or reactive.
For example, a proactive control is something which is a directive control,
tells us what we can or cannot do,
a deterrent just to discourage somebody from doing something wrong,
or preventive control to try to make sure they can't do something wrong.
All of these happened before something went wrong.
Therefore,
we call them safeguards because they are there to
safeguard our systems and assets.
But we also need reactive controls.
We often call these countermeasures because they are there
specifically to counter some type of an event.
And the three most common countermeasures are detective controls,
corrective controls, and recovery controls.
Let's look at how all of these controls fit together.
We said there were three main types of controls,
managerial, technical, and physical or environmental.
And then we saw the three which were safeguards and the
three which were then countermeasures.
So what would be an example of a managerial directive control?
An acceptable use policy that tries to tell people this is what you can do,
this is what you shouldn't do, so hopefully you don't do something wrong.
That's a direction that we provided to the reader of that policy.
Technically,
a person goes on to a computer system and they see this warning banner
on their screen that says this is a private system,
don't go further.
That's a technical type of directive control.
Physical is where you have a sign at the edge of the
property that says do not enter,
but some people don't take direction very well, so we
need to also sometimes have a deterrent.
A deterrent is the type of control which would discourage
somebody from doing something wrong.
Look, we told you don't do it,
but this is also telling you what's going to happen if you do.
For example, if a person doesn't abide by policy,
they could face disciplinary action.
Technically,
we have a little note that says all actions on this system are monitored,
and so people realize I better not do something wrong
because somebody will have a record of that.
Physically, we had a sign that says do not enter,
but underneath that sign is a second one that says beware of dog.
You know, sometimes you could socially engineer maybe a security guard,
but it's very hard to socially engineer a German Shepherd
or a Rottweiler with a bad attitude, so that that's a deterrent we could say.
Preventive controls are things like separation of duties.
We saw earlier how having separation of duties can actually help
us to then prevent fraud or even mistakes.
Technically, well we told you that this is a private system,
and we told you we're going to monitor,
but we also have a password and that password would stop
you or prevent you from being able to log in if you didn't
have the correct password.
And physically, the fence.
Yeah, it's a sign, but of course,
the fence can make it a little bit more difficult
to get on that property as well.
So those are examples of all three types of controls from the
perspective of what we called here safeguards.
The three types of reactive controls, such as,
should we say, here a detective reactive control,
would be something like an audit done by management to see if
there was something that was done incorrectly or not in
accordance with policies or procedures.
Technically,
we have systems like obviously logs that record everything that
happened and an intrusion detection system that would then pick up any
activity that seems suspicious on the system.
Physically,
a very good example of a detective controller would be a smoke detector,
would detect where there is obviously some type of
should we say serious incident.
When something goes wrong,
we talked about this in incident management that we want
to be able to contain the problem.
That's where we put in place corrective controls,
and this does not fix the problem, but at least it stops it from spreading.
So a managerial corrective control could be sometimes that we will
remove that employee from the workplace until we've done the
investigation so they can't delete any, should we say,
logs or activity they had.
Technically, we isolate the system.
Of course, physically, if the smoke detector goes off,
it's really good to have a fire extinguisher.
A fire extinguisher is a very good example of a corrective
control and that it contains and stops the fire,
but it certainly doesn't fix up the damage.
We could also have something like a man trap,
which means that if a person was trying to steal from a
jewelry store and they go rushing out,
they get stuck between the two different doors so that
they are unable to exit from that area.
When we talk about recovery controls,
we're trying to get back to normal and fix things up.
Managerially,
we do things like awareness sessions so people know what to watch
out for so it doesn't happen again, technically,
we might have to rebuild that system from our backups, and physically,
after a fire, of course, rebuild as well.
These are just examples of some of the many types of controls we
can use to help us to understand how we have all these different
combinations that we can use to address risk in what we would say
is an appropriate manner.
So how do we know which controls to choose?
Well, we quite often will look at what is available,
what has been recommended, or in some cases,
what has been mandated.
We have some cases where it'll say you must deploy this type of a control.
And there are some very good sources for this from NIST,
a document known as the special publication 800‑53,
hundreds of pages of recommended controls we should put in
place depending on what our level of risk is.
The payment card industry has the document known as the data security standard,
and it has a list of over 130 different controls that we
should put in place if we're dealing with something
sensitive such as a payment card, a credit card,
or debit card.
We also have to know what controls are even available,
what tools and technologies are available,
and certainly that are available within a reasonable timeframe.
In a number of cases,
the challenge I'm going to have is that there could be new controls coming,
but they're not ready yet.
We need controls that will be effective when this incident happens,
not, you know, the problem with a log.
A log tells us that something happened,
but it might be that it happened a year ago.
We want, in many cases,
a control that can tell us as it's happening in near real time.
Very often,
we will look at put in new controls or it could well be we just need to
enhance or should we say improve the controls we currently have.
In many cases, we may require more than one control.
We need a policy, and we need a firewall, and we need to put a lock on the door.
All three of these might be necessary in order to be
able to mitigate a significant risk.
The other thing is, what does the control cost?
As we know,
the general rule is don't pay more to protect something than it's worth.
So we have to look at what we often call cost‑benefit analysis.
What is the cost of this control as compared to the
benefit that that control will provide?
Now this is not easy because the cost of control is not
just the purchase price of the control, but instead,
we also have to look at what is the ongoing impact on productivity,
maintenance of the control.
For example,
you put a password on a system, that didn't really cost much to
check that little box that says require a password,
but how many calls is this going to result to the help desk?
How much productivity is going to be impacted
because people forgot their password?
They came in on a Monday and it took an hour before
they could get on the system.
So the cost of the control should be considered from
that larger perspective as well.
But then, of course, we have to look at the benefit.
Would that benefit justify that cost?
Then we document the controls we have in place and where we've reduced a risk,
we'll go back to our risk register that had all of our known risk and now note
that this risk has been reduced through the use of a control.
The key points review.
Risk justifies controls.
We can see here that controls are selected based on what
is the risk appetite of management, what controls are even available,
and cost benefit analysis.