IT Security Controls
IT security controls play a foundational role in shaping the efforts security professionals take to protect an organization. Security Controls are protecting things that are of utmost importance to an organization. That generally includes property, people, and data also known as assets of the organization.
They are functional in reducing and mitigating risks to those assets. These controls include policy, procedure, process, action, plan, solution, or device designed and implemented to accomplish a goal.
Types of IT Security Controls –
Physical Controls are anything tangible used to detect or prevent unauthorized access to physical areas, systems, or assets. These controls encompass things like fencing, locks, guards, access control cards, biometric access control systems, surveillance cameras, and intrusion detection sensors.
Technical Controls are logical controls such as software or hardware mechanisms functional in protecting assets. Some examples of technical controls are authentication solutions, firewalls, antivirus software, encryption measures, etc.
Administrative Controls refer to policies, procedures, or guidelines that describe personnel or business practices in line with the organization’s security goals. Some examples of administrative controls are policies and procedures for– employee hiring and termination, Physical access to facilities, segregation of duties, etc.
Security Controls necessarily fall under one of the functions of the following controls
Preventive Controls describe any security measures taken that are designed to prevent unwanted or unauthorized activity from occurring. Examples of preventive controls are physical controls like locks, alarm systems, and fencing; technical controls like antivirus software, firewalls; administrative controls like segregation of duties, data classification.
Detective Controls describe security measures implemented to detect and alert unwanted or unauthorized activity in progress or after it has occurred. Examples of detective controls are door alarms, fire alarms, Honeypots, and IDSs.
Corrective Controls describe any measures taken to repair the damage or restore resources to their prior state an unwanted or unauthorized activity. Examples of corrective controls are patching a system, terminating a system, Incident response plan.
| Control Functions | ||||
| Preventive | Detective | Corrective | ||
| Control Types | Physical | Parameter fencing, Gates, Locks | CCTV and Surveillance Camera logs | Repair Physical damage, reissue access cards |
| Technical | IPS, MFA, Firewalls, and Antivirus | IDS, Honeypots | Patch a system, terminate a process | |
| Administrative | Hiring and termination policies, segregation of duties | Review access rights, audit logs, and unauthorized changes | Implementing Incident Response and BCP plans | |
Diagram: Control types across different control functions with their examples
These are not chosen or implemented arbitrarily. While choosing security controls for an organization, the security professionals should take into consideration—the risk management process of the organizations, the strategies and of an organization w.r.t IT security, Industry of the organization, Applicable laws/ regulations.
Security professionals while implementing security controls generally opt for a combinational approach, where two or more types of controls are implemented simultaneously. These controls are tailored to the strategies and compliance goals of the organization. The ultimate goal of these security controls is to uphold the three basic foundational principles of security—Confidentiality, Integrity, and Availability.
Want to connect, please click here.
Author,
Sobiya Munshi,
Audit and Compliance Team,
Varutra Consulting Pvt. Ltd.
