Security controls

Security controls, security measures or countermeasurs are safeguards to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets. In the field of information security, such controls protect the confidentiality, integrity and availability of information. Systems of controls can be referred to as frameworks or standards. Frameworks can enable an organization to manage security controls across different types of assets with consistency. Security controls reduce the likelihood of any impacts of security incidents and protect the CIA triad for systems and data. Protecting the CIA triad helps organizations meet their responsibilities through consistent risk management of systems, assets, data, networks and physical infrastructures. The definition of countermeasure is given in IETF RFC 2828 and CNSS Instruction No. 4009 dated 26 April 2010 by the Committee on National Security Systems. According to the Glossary by InfosecToday, the meaning of countermeasure is: :The deployment of a set of security services to protect against a security threat.

Security controls, security measures or countermeasurs are safeguards to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets. In the field of information security, such controls protect the confidentiality, integrity and availability of information. Systems of controls can be referred to as frameworks or standards. Frameworks can enable an organization to manage security controls across different types of assets with consistency. Security controls reduce the likelihood of any impacts of security incidents and protect the CIA triad for systems and data. Protecting the CIA triad helps organizations meet their responsibilities through consistent risk management of systems, assets, data, networks and physical infrastructures. The definition of countermeasure is given in IETF RFC 2828 and CNSS Instruction No. 4009 dated 26 April 2010 by the Committee on National Security Systems. According to the Glossary by InfosecToday, the meaning of countermeasure is: The deployment of a set of security services to protect against a security threat. ==Overview== A resource (both physical or logical) can have one or more vulnerabilities that can be exploited by a threat agent in a threat action. The result can potentially compromise the confidentiality, integrity or availability properties of these resources (potentially different than the vulnerable one) of the organization and other involved parties (customers, suppliers). The so-called CIA triad is the basis of information security. The attack can be active when it attempts to alter system resources or affect their operation: so it compromises integrity or availability. A "passive attack" attempts to learn or make use of information from the system but does not affect system resources, compromising confidentiality. A threat is a potential for violation of security, which exists when there is a circumstance, capability, action, or event that could breach security and cause harm. That is, a threat is a possible danger enabling the exploitation of a vulnerability. A threat can be either "intentional" (i.e., intelligent; e.g., an individual cracker or a criminal organization) or "accidental" (e.g., the possibility of a computer malfunctioning, or the possibility of an "act of God" such as an earthquake, fire, or tornado). A set of policies concerned with information security management, the information security management systems (ISMS), has been developed to manage, according to risk management principles, the countermeasures in order to accomplish to a security strategy set up following rules and regulations applicable in a country. ==Types of security controls== Security controls can be classified by various criteria. One approach is to classify controls by how/when/where they act relative to a security breach, sometimes termed as control types: Preventive controls are intended to prevent an incident from occurring e.g. by locking out unauthorized intruders; Sometimes known as firewalls or locked server rooms that restrict physical entry Detective controls are intended to identify, characterize, and log an incident e.g. isolating suspicious behavior from a malicious actor on a network or using network monitoring tolls to flag suspicious activity.; Compensating controls mitigate ongoing damages of an active incident, e.g. shutting down a system upon detecting malware After the event, corrective controls are intended to restore damage caused by the incident e.g. by recovering the organization to normal working status as efficiently as possible. Security controls can also be classified according to the implementation of the control (sometimes termed control categories), for example: Physical controls - includes tangible items such as fences, doors, locks, CCTV systems and fire extinguishers; Procedural or administrative controls - e.g. incident response processes, management oversight, security awareness and training. Technical or logical controls - e.g. user authentication (login) and logical access controls, antivirus software, firewalls; Legal and regulatory or compliance controls - includes privacy laws, policies, regulations and clauses that help organizations handle and protect (e.g. HIPAA, GDPR). These classifications help organizations build a well-designed, multi-layered defense strategy in which different layers help control and prevent threats as they occur. ==Information security standards and control frameworks== The ISO/IEC 27000 series standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. The most recent version, ISO/IEC 27001;2022¹, released in October 2022, specifies 93 controls; some of the most well-known standards are outlined below. ===International Standards Organization=== ISO/IEC 27001:2022 was released in October 2022. All organizations certified to ISO 27001:2013 are obliged to transition to the new version of the Standard within 3 years (by October 2025). The 2022 version of the Standard specifies 93 controls in 4 groups: A.5: Organisational controls A.6: People controls A.7: Physical controls A.8: Technological controls It groups these controls into operational capabilities as follows: Governance Asset management Information protection Human resource security Physical security System and network security Application security Secure configuration Identity and access management Threat and vulnerability management Continuity Supplier relationships security Legal and compliance Information security event management; and Information security assurance The previous version of the Standard, ISO/IEC 27001, specified 114 controls in 14 groups: A.5: Information security policies A.6: How information security is organised A.7: Human resources security - controls that are applied before, during, or after employment. A.8: Asset management A.9: Access controls and managing user access A.10: Cryptographic technology A.11: Physical security of the organisation's sites and equipment A.12: Operational security A.13: Secure communications and data transfer A.14: Secure acquisition, development, and support of information systems A.15: Security for suppliers and third parties A.16: Incident management A.17: Business continuity/disaster recovery (to the extent that it affects information security) A.18: Compliance - with internal requirements, such as policies, and with external requirements, such as laws. ===U.S. Federal Government information security standards=== The Federal Information Processing Standards (FIPS) apply to all US government agencies. However, certain national security systems, under the purview of the Committee on National Security Systems, are managed outside these standards. Federal information Processing Standard 200 (FIPS 200), "Minimum Security Requirements for Federal Information and Information Systems," specifies the minimum security controls for federal information systems and the processes by which risk-based selection of security controls occurs. The catalog of minimum security controls is found in NIST Special Publication SP 800-53. FIPS 200 identifies 17 broad control families: AC Access Control AT Awareness and Training AU Audit and Accountability CA Security Assessment and Authorization (historical abbreviation) CM Configuration Management CP Contingency Planning IA Identification and Authentication IR Incident Response MA Maintenance MP Media Protection PE Physical and Environmental Protection PL Planning PS Personnel Security RA Risk Assessment SA System and Services Acquisition SC System and Communications Protection SI System and Information Integrity National Institute of Standards and Technology ===Commercial Control Sets=== ====COBIT5==== A proprietary control set published by ISACA. Governance of Enterprise IT Evaluate, Direct and Monitor (EDM) – 5 processes Management of Enterprise IT Align, Plan and Organise (APO) – 13 processes Build, Acquire and Implement (BAI) – 10 processes Deliver, Service and Support (DSS) – 6 processes Monitor, Evaluate and Assess (MEA) - 3 processes ==Telecommunications== In telecommunications, security controls are defined as security services as part of the OSI model. These documents specify mechanisms such as authentication, access control, and data confidentiality to protect any network communications: ITU-T X.800 Recommendation. ISO ISO 7498-2 These are technically aligned. This model is widely recognized. ==See also== Access control Anti–computer forensics Aviation security Common Vulnerabilities and Exposures (CVE) Common Vulnerability Scoring System (CVSS) Computer insecurity Computer security Countermeasure Defense in depth Environmental design Exploit (computer security) Full disclosure (computer security) Gordon–Loeb model for cyber security investments Information security IT risk Metasploit Month of Bugs Physical Security Risk Security engineering Security management Security services Security Vulnerability management w3af ==References==

Text derived from https://en.wikipedia.org/w/index.php?oldid=1378153892 under CC BY-SA 4.0; modifications have been made.