A defense or countermeasure to put in place to manage risk.
Policies, strategies, technologies, configuration settings, etc. established in collaboration with various departments of an organization to help mitigate known risks.
The means of managing risk, including policies, procedures, guidelines, practices, or organizational structures, which can be an administrative, technical, management, or legal nature.
Control Categories
Technical / Logical Controls
Implemented through technology.
May be deterrent, preventive, detective, or compensating.
Examples:
Patching
Firewalls, IDS/IPS
Access Controls
Administrative / Management Controls
Purpose: to implement security policies based on procedures, standards, and guidelines.
Documents, policies, procedures, and guidelines.
Acceptable Use Policy
Incident Response Plan (IRP)
People/Personnel
Security Operations Center
Guards
Surveillance
Security Awareness Training
Physical / Operational Controls
Reduce the risk of harm coming to physical property, information, computer systems, or other assets.
Examples:
Hardened Facility
Locks
Badges
Control Types
Deterrent Controls
Intended to discourage individuals from intentionally violating security policies, procedures, or technologies.
Highly visible.
Prevent offenses or abuses by influencing choices.