Security Controls - Types, Categories, and Functions

Security controls, you know you want them,

you know you need them, but you don't

know about them. I'm going to solve that

problem for you coming up now.

Hello everybody! My name is Adam

Gordon, an edutainer here at ITProTV.

I want to have a conversation with you

about security controls, something most

of us probably think we understand and

do a good job with in our businesses, but

in reality we probably need a little bit

of additional guidance answering three

specific questions, hopefully it's going to

help us to do that. And we need to make sure

we're focusing our discussion around the

primary goal of using security controls

which is addressing a dreaded

four-letter word, not the one you're

probably thinking about, but this one

right here that I'm putting on the

lightboard for us, which is risk. This is

the key to understanding and unlocking

not only our ability to be able to use

security controls, but really helping us

to understand and put into context what

they can do and how they help us to

achieve that. Let's frame those three

questions I was talking about just a

moment ago. How do we describe

security controls is where I want to

begin because understanding the key

descriptors, the difference between

categories and types, is going to help us

to understand the value that security

controls provide. That value is best

discussed and framed by answering the

question why? Why do we need security

controls? Why are they valuable to our

business? And finally let's talk about

what? What are security controls able to

do for us? Specifically, what are these

seven types of controls we have sitting

over here actually going to help us

to accomplish. Let's jump in and begin by

talking about how we describe security

controls. We have categories over here on

the lightboard and categories are going

to help us to group together controls at

a high level. They may be administrative

in nature, policy based giving us

guidance that's going to help us to

understand how things should be done

aligning with business requirements,

regulatory, statutory concerns, things of

that nature. Technical logical controls

are operating system driven, they're

implemented through software, and they're

going to allow us to implement

safeguards, controls, counter measures, all

synonyms for one another by the way, that

allow us to treat risk, minimize it, and

minimize its impact specifically on us,

our business, and, of course, the assets of

the organization. But the key here is

that they're software-based, they're

implemented through the operating system

and or an application, both of which are

software. And finally as a category,

physical controls. I often refer to these

as the guards, guns, and gates

conversation when I talk to customers

and students. These are controls that

manifest themselves in the physical

world, we can touch them, feel them,

interact with them. Literally they are

guards, they are guns, they are gates, and

a variety of other physical measures

like doors and windows and closed

circuit TV monitoring that allow us to

understand our environment and in one

way or another monitor and constrain it.

When we think about categories, in other

words, we think very broadly about

groupings of controls based on some sort

of approach or functionality. As we then

get more granular, more tactical in our

approach with regards to defining

controls. We turn our attention to types.

And types, as you could see there are

seven of them here, are going to allow us

to understand how we can make a very

specific choice to help us to impact and

minimize risk and in so doing, allow us

to address risk so that we can push it

down as far as possible, trying to

minimize that impact in the

organization and more broadly, throughout

the organizational environment across

all the things we do and of course

across all the assets that we operate

with. And so as we think about how we are

describing, we want to make sure we

understand that categories are very

broad and types are very specific. That's

a really important takeaway from the

first question. Let's turn our attention

to why. Why do we want to use controls?

Why are they valuable to an organization,

to you as an individual, and by extension

to your organization? Well they give us

the ability, as we were just talking

about, let's draw our other arrow here to

really highlight us on this, they give us

this ability to do the following,

right? Make sure that we try to

get rid of risk if it all possible, even

draw a little line over here just to

make sure we see it's kind of x'ed out.

Now the reality is we're never going to

completely get rid of risk, there's

always going to be some risk left which

is why I left the word risk right in the

middle of the diagram there. But the

reality is we could certainly shrink

that circle, minimize that risk, write it

much, much smaller, right? So that we can

see that yeah it's a lot smaller than it

was and as a result, a lot less impactful

to us. And controls are going to really

help us to get to that point. And that's

the why. Let's talk now about the what,

right? Specifically, I've already defined

the idea of what the categories provide

for us in terms of groupings but I

haven't really touched on what the

individual types of controls are. I want

to run them down for you quickly, make

sure you have a high level understanding

of the seven distinct controls and therefore

the seven choices we get to make with

regards to how we try to minimize that

risk down, make it as small and tiny as

possible. Let's start at the top here

with directive. When we think about directive

controls, we're thinking about controls that

provide guidance that are aligned

primarily with the administrative

category. They're very likely policy

nature, policy in nature, policy driven,

and or policy like and they're giving us

specific guidance, aligning us with one

or more requirements that the

organization has fundamentally laid out

and made clear we need to follow. And so

when we think about this, we're thinking

about really controls that are going to

give guidance but guidance from a policy

driven standpoint or vantage point. They

tell us to do something and they may or

may not tell us why it's important to do

that. Deterrent controls are going to

often be paired, let's just make a little

connector here so we can see this

pairing, are often going to be paired

with preventative controls. People tend

to confuse the two. I want to make it clear

for you what they are. But we should see

them as essentially two sides of the

same coin. Deterrent controls, and the name

itself kind of implies what the

definition is, deterrent controls are

meant to discourage behavior. You walk up

to a community or a house or an area

that's fenced off, it has a fence, it has

a gate, has a guard, has a big sign that

says do not trespass bad dog. Well that

hopefully is enough to deter you, to make

you make smarter choices and not decide

to try to go in there when you don't

belong or aren't invited. Whereas a

preventative control is meant to stop

you if you really don't make good

choices because the deterrence was not

enough. If we add to all those things I

just described, a layer, a series behind

that fence of guards that are standing

there waiting to capture you and escort

you off the property, then that's going

to prevent you from getting inside and

as a result, even if you make a bad

choice, we're going to stop you. And so

when we think about both deterrent and

we think about preventative controls, we

think about ways in which we can either

encourage you to make good choices or

stop you if you make bad choices. Let's

talk about compensating controls.

Compensating controls, these are designed

to step in and allow us to have a

secondary control, a backup system if you

will, that will prevent something bad

from happening because the primary

control that we were relying on for some

reason is not operable or has failed. So

if you imagine for instance that we have

a computer that runs normally, plugged

into our wall, getting power from the

power grid from the electricity provider,

the utility company, and everything is

fine except when there's a storm and the

power is interrupted. Well if we had a

compensating control, we would use a

backup battery solution, what we call a

UPS, an uninterruptible power supply,

where we plug the computer instead of

into the wall, into the battery box that

then is plugged into the wall. During

normal operations we get power directly

from the utility company, everything's

fine, but when the power cuts off we

still have power from

the batteries and the computer could

still be run safely for a period of time,

shutting it down, eliminating and

significantly reducing the likelihood

we're going to damage the data or damage

the system by shutting it down hard,

as we said, right, with no power all of

sudden just turning it off. So

compensating controls are meant to

offset the loss of a primary control and

the primary control could be one of the

other types whatever they are. Let's turn

our attention to detective controls. Well

detective controls are just like

detectives in real life. They look for

clues and they try to tell us and alert

us and show us that things are abnormal

and that we should pay attention to them

'cus likely something bad has happened or

is about to happen and we're seeing it

unfold in near real time. So detective

controls, just like Sherlock Holmes or

any detective that you like, are good

sleuths. They look for things and they

help us to uncover activity that's

probably going to be an issue for us and

then we want to take action to correct.

Corrective controls, having just said the

word, corrective controls are those

controls that allow us to take action

after something most likely has been

detected, some bad thing has happened, and

we want to put it right, we want to get

back to normal, we want to stop having

this issue and return operations to the

way they were before this occurred. Now

corrective and recovery controls are

also usually grouped together by the way

because recovery controls are like an

extension of corrective controls but

they have more features, more capability,

more depth. They're technically, in other

words, going to give us more options and

they're often used in combination with

corrective controls to, again, restore

systems and operations to normal after

some sort of bad event has occurred, but

to do so with more capabilities more

often than not. So these seven makeup our

types, group together into one of three

categories, and what we then have

ultimately is our ability to bring this

all together to shrink risk into a more

manageable size, hopefully minimizing it

enough that the impact to our

organization is negligible or certainly

less than it would have been otherwise.

You could see the size difference there

hopefully indicates that, and as a result

we live to fight another day. I've been

Adam Gordon talking to you about

security controls on behalf of ITProTV.

If you want to learn more about security

controls or any of the other thousands

of things we talk about and teach about

every day. I always want to invite you to

come and take a look over at ITProTV,

spend some time with us. Myself and all

my fellow edutainers are always up for

opportunities to spend time with you,

helping you to better understand your

world and making sure you have all the

knowledge you need to be successful. I'll

be back soon with another conversation

but until I am, I'll wish you happy

securing and I'll see you soon.