-: Policy-based controls.
So, in this lecture,
let's dig a little bit deeper into policy.
So, when we talk about the policy,
we talk about the overarching guidance.
We talk about the desired end state that management intend.
We wanna have a secure network.
We wanna make sure that we don't suffer
from any data breaches.
We wanna make sure nobody can steal
our customers' information from our web server.
These are all overarching ideas and goals,
but they don't provide any specific way to accomplish them
and that's where policy-based controls come in
because they are gonna provide the control objectives
that we want to achieve.
These things are categorized in one of three methods.
They're either called physical controls, logical controls,
or administrative controls,
and they help give us the specific details
of what we're gonna do to meet our policy objectives.
Now, I know this sounds all lofty
and high-level goals at this point,
but let's start digging into these three examples
and you're gonna understand exactly what those controls are.
Physical controls.
Physical controls are controls
that will impact the physical world.
So, if I start having fences
and gates and locks and lighting
and alarming systems, fire suppression systems,
all of that kind of stuff,
that's a physical control.
If I wanna make sure that no attackers
can get into my facility and touch my servers
to pull the hard drive out and steal the data,
well, I could put up fences and mantraps and locks
to prevent that from happening.
Those are the way we accomplish that goal.
Now, when we talk about logical controls,
these are all the technical things that we do
to enforce our confidentiality, integrity, availability,
and even our nonrepudiation.
Now, here we can use things like ACLs
inside of our firewalls or our routers.
We can use encryption schemes
or a host of all the other technical things
that you think of when you think of cybersecurity.
Most of those tend to be logical controls.
Now, when we go to administrative,
this is where we start talking about procedural controls
that are there to implement good cybersecurity practices.
These are our policies and our procedures, right?
We can codify these things.
It's things like separation of duties, background checks,
reviewing your log files and many more.
We're gonna dig in deeper into these three controls
in a little bit but for now,
just remember that you have physical,
talks about the physical world,
the things you can touch and feel;
logical is all the technical stuff;
and administrative are usually policies and procedures
that are gonna help you get better security.
Now, when you combine these control objectives,
you get more power than using them alone.
Just like the concept of defense in depth.
When I combine the fence on the outside
to protect somebody from breaking in physically
with some logical security cameras
or biometric authentication at the mantrap,
those two, logical and physical controls, come together
to give me more security than either one would by itself.
So, let's take an example.
If I wanna prevent the theft of data from a server,
I would need physical controls.
I need to prevent access to the building
so that's the locks, the mantraps, the security cameras,
all of that physical stuff to keep people away.
Then I have logical controls.
That will be things
like the data on the hard drive would be encrypted
so even if you did get in through the physical way
and stole the hard drive,
the data wouldn't be any good to you
because it's all jumbled up.
And then we might have administrative controls.
So, in addition to having the locks on the door
to the server room,
we may have it where you need two different keys
to open that lock.
So, we'd have to have two people to open that door
to be able to get in and break through the physical.
So, you see how these things layer on top of each other
to really start giving us that defense in depth
and that extra protection that we want
by combining those objectives.