-: Now that we've dug into the concept
of risk a little bit more,
I think it's appropriate for us
to cover the concept of security controls
because that's exactly what we're going to use
when we try to mitigate a particular risk.
Now, security controls are first broken down
into three types, physical, technical and administrative.
As you might guess,
physical controls are security measures
that are designed to deter or prevent
unauthorized access to sensitive information
or the systems that contain it,
by preventing physical access.
So when we discussed physical security
earlier in this course,
we were focused on a lot of physical controls
like fences and door locks
and alarm systems and security guards,
all of these things are focused
on protecting the physical computers, servers and networks
from being accessed by people outside our organization.
Our second type of security control
is called the technical control.
Technical controls are safeguards and countermeasures.
They're used to avoid, detect, counteract, and minimize
our security risks to our systems and information.
So we talk about using passwords and access controllers,
and encryption for our hard drives
and multi-factor authentication,
we're really talking about technical controls here.
The third type of security control
is called an administrative control.
Administrative controls are focused
on changing the behavior of people
instead of removing the actual risk involved.
So if I create a policy or procedure,
that states that every employee has to lock their computer
whenever they're going to be away from their desk,
this is an administrative control.
There's no technical control being used here.
If you get up and walk away and return within two minutes,
and you didn't lock your workstation,
there's no technical control that's going to lock it for you.
I just made up a policy and it's purely administrative.
Now, other examples of this include things
like mandatory vacations, user education and training,
creating disaster recovery plans,
and implementing job rotation,
all of these are examples of administrative controls.
Now, the National Institute of Standards and Technology
or NIST, actually has three other categories
that we organize Security Controls in as well.
These are management controls,
operational controls and technical controls.
Management controls are security controls
that are focused on decision-making
and the management of risk.
This usually includes things
like policies, procedures, legal compliance,
software development methodologies that you choose,
setting up a good vulnerability management program,
and other things like that.
Management controls are all about how your system security
is going to be managed and overseen.
Now, operational controls are focused
on things that are done by people.
With operational controls I'm trying to increase
the security of the system, by controlling the actions
of the individuals and the groups who use it.
This includes user training, configuration management,
testing our disaster recovery plans,
and conducting incident handling.
These controls are performed by technical people
in order to carry out the overall direction
that was provided by management controls.
The third category NIST uses, is called technical controls.
These are logical controls that are put
into a system to help secure it.
This is things like triple A,
the authentication, authorization and accounting,
access control, encryption technology, passwords,
and configuring your security devices.
Anything that is technical and performed by the computer
can really be put into this category.
So, now that we've covered two different groups
of three categories each,
I bet you think we're done but unfortunately, not quite yet.
We have yet another group of three,
that can be used to describe security controls.
They are preventive, detective, and corrective.
Preventative controls are security controls
that are installed before an event happens,
and they're designed to prevent something from occurring.
For example, you might install
a technical control like a RAID in your file server,
to ensure that your data always has redundancy available
and prevent data loss from occurring.
Maybe you're worried about a power outage,
so you install battery backup or an UPS,
in order to prevent a brownout or a blackout from happening
and causing your workstation to lose power.
These are considered preventative controls.
The second type of control is called a detective control.
Detective controls are used during an event
to find out whether or not something bad may have happened.
If you have a closed-circuit TV system,
being monitored by a security guard,
this is a type of detective control.
Intrusion detection systems, audit logs and alarms
are all different types of detective controls as well,
when they have logging enabled.
Now, these aren't going to stop a bad thing from happening
but they are going to allow you to at least know
that it happened and follow up on it.
The third type of control is called a corrective control.
Corrective controls are used after an event occurs.
So, let's say somebody hacks into your server
and they erase your hard drive,
well if this happens you're going to hope
you have a good backup copy somewhere.
If you've been doing good tape backups,
this is called a corrective control
because it's going to allow you to recover from this data loss
and by fixing something after it happens,
it becomes a corrective control.
Other examples of this are found
as part of incident response or disaster recovery,
or restoring technologies for data loss,
or replacing devices that've been malfunctioned,
or switching your operations to an alternate location,
to continue your business functions
in case there's a disaster and you need
a continuity of operations.
So you may be wondering, can something be in one
or more categories?
Well, absolutely.
I've mentioned some of them as we've gone through.
Consider the example of a closed-circuit TV system,
if I have it installed it can serve as a detective control
because I can see if something's happening,
but it's also categorized as a physical control
because it protects our physical devices
by allowing us to see people as they approach the devices.
Similarly, if I have a password policy
created for my organization,
this isn't just a management control
but it's also an administrative control because again,
policies fall into both those areas.
Now, I know we've covered a lot of different controls so far
but I have just one more control to cover,
it's called a compensating control.
Now a compensating control is used whenever you can't meet
the requirements for a normal control.
For example, let's say your organization
has a physical security policy
that states that every door to a networking closet
or server room has to have a retina scan enabled door lock,
to protect the devices in those rooms.
Well, maybe one of your branch offices is located
in some far off country overseas,
and they have no retina scan enabled door locks
being sold in that region.
Well, instead of using a retina scan door lock,
you decide to install a cipher door lock.
The cipher lock will be considered a compensating control
until you can get a retina scan enabled door lock
ordered, shipped and installed at this location.
Now, keep in mind that if you use a compensating control,
you are putting in place a different thing
than the original requirement,
but you're still attempting to get the same level
or close to the same level of security.
Any residual risk that is not covered
by the compensating control is considered
accepted risk by the organization
because this security control doesn't fully cover
the same requirements as the original control might've.
For the exam, I want you to make sure you're prepared
to categorize things into these different types of controls,
based on the ten types of security controls
we covered in this lesson.
Keep in mind, some things can go
into multiple categories and that's okay,
that's why I presented these things in the three groups
of three, and then the compensating control.
(electronic music)