-: Types of Controls.
So in this lecture, we're gonna dig in a little bit deeper
into the different types of controls you can use
to bring down the threat into your network.
So these controls are gonna prevent, detect,
counteract and limit certain security risks for you
and try to reduce that threat picture.
You have ones like technical, administrative and physical,
which we've mentioned before and those are all based on
the implementation of how those controls are used.
But we also have another way of looking at things
which is how the control acts
and that would be things like preventive controls,
detective controls, corrective controls
and compensating controls.
We're gonna cover each of those in this lesson.
Now the first one we're gonna talk about
is technical controls.
And these are designed to provide security
through technical means.
This would be things like firewalls,
Intrusion Detection or Intrusion Protection Systems,
antivirus, authentication systems, network segmentation
or any of a myriad of other technical controls
that we can apply to reduce the threat in our networks.
And then next one that we're gonna be looking at
is administrative controls.
And these are called also procedural controls.
Administrative controls are designed to provide security
through processes and procedures.
This is where all of the policy that we have
gets trickled down into action, right.
Now, there's also another kind called legal controls
and it's kind of a subcategory of administrative controls.
These are all the things that you're required to do by law
like Sarbanes-Oxley, HIPAA, FERPA,
those kind of things right.
Now some examples of administrative control
would be having an incident response plan,
having user awareness training,
account creation policies and procedures,
acceptable use policies and procedures,
separation of duties.
All of these things feed into administrative controls.
Now the next one we want to talk about is physical controls.
We mentioned this previously that this design
is to provide security by preventing physical access
or harm to the organization's systems or facilities.
This is things like having fences, mantraps, security guards
and fire suppression systems.
If you have all that stuff, you're protecting yourself
in the physical world.
So we talked about those three previously
but let's get into some new ones here.
And the ones we're gonna talk about here
is how things are implemented and how they're acted on.
So preventative controls are proactive measures.
These are designed to stop an incident
before it has occurred.
These are things like firewalls, antivirus,
training and security guard.
You can see how these things overlap, right.
We talked about security guard
and that's a physical control and a preventive control.
If we talk about a firewall, that's a preventive control
and a logical or technical control.
So there are these things that kind of overlap
and you have to consider that
when you think about your different controls.
The next one we'll talk about
is what's called a detective control.
And a detective control is designed to detect
when an incident occurs, capture details about it
and send an alarm or notification
to someone who can act on it.
So these would be things like an Intrusion Detection System,
a security camera or a log.
All of those things are detective controls.
They help us put the picture back together
after an incident has happened.
The next one we're gonna look at
is what's called a corrective control.
This is rather reactive in nature.
This is designed to fix an issue
after an incident has occurred.
So this is part of your incident response process
and it involves things like security patching,
system rebuilding and restoring from backups.
All of these would be corrective actions
even though they would fit probably into a technical
or logical control as well, right.
So the next and last one we're gonna talk about
is a compensating control.
A compensating control is used
to satisfy security requirements
that aren't met by any of the other controls
we've talked about.
So this is gonna minimize the threat
down to what's called an acceptable risk level.
So a good example of this is when we have to compensate
for something that we can't correct yet.
So for instance, let's say your organization
is using Windows 7 as its Operating System
and you can't upgrade yet to the newest version
of Windows 8 or Windows 10.
Well, there's bugs in Windows 7
that maybe there's not a patch for yet.
Like for instance, maybe there's an attack
that comes over port 445, like the EternalBlue exploit.
Well, you can block port 445 at the firewall.
It doesn't solve the issue but it does prevent
an outside threat actor from acting upon it
so it's considered a compensating control.
It's good enough to bring the threat level down
even though the threat has not completely gone away.
And this would be something of this nature, right.
We can also do things like segmenting vulnerable software
into some other part of the network.
Maybe you have some custom-built software
that somebody built for you back in the 1980s or 1990s
or in the early 2000s and it still runs on
something like a Windows 2000 server
or a Novell NetWare server, right.
Those things are really, really old
and there's not any patches available for 'em anymore.
But you can't get off that system yet
because you haven't built a new one.
Well, you might want to segment that off
into a standalone network where therefore
it minimizes the amount of people who can get in and out
of that network and that's a good compensating control.