Security Controls - Types, Categories, and Functions

security controls you know you want them

you know you need them but you don't

know about them I'm going to solve that

problem for you coming up

now hello everybody my name is Adam

Gordon an Entertainer here at it pro TV

want to have a conversation with you

about security controls something most

of us probably think we understand and

do a good job with in our businesses but

in reality we probably need a little bit

of additional guidance answering three

specific questions hopefully he going to

help us to do that we need to make sure

we're focusing our discussion around the

primary goal of using security controls

which is addressing a dreaded

four-letter word not the one you're

probably thinking about but this one

right here that I'm putting on the

lightboard forest which is risk this is

the key to understanding and unlocking

not only our ability to be able to use

security controls but really helping us

to understand and put into context what

they can do and how they help us to

achieve that let's frame those three

questions I was talking about just a

moment moment ago how do we describe

security controls is where I want to

begin because understanding the key

descriptors the difference between

categories and types is going to help us

to understand the value that security

controls provide that value is best

discussed and framed by answering the

question why why do we need security

controls why are they valuable to our

business and finally let's talk about

what what are security controls able to

do for us specifically what are these

seven types of controls we have sitting

over over here actually going to help us

to accomplish let's jump in and begin by

talking about how we describe security

controls we have categories over here on

the lightboard and categories are going

to help us to group together controls at

a high level they may be administrative

in nature policy based giving us

guidance that's going to help us to

understand how things should be done

aligning with business requirements

regulatory statutory concerns things of

that nature technical logical controls

are operating system driven they're

implemented through software and they're

going to allow us to implement

safeguards controls counter measures all

synonyms for one another by the way that

allow us to treat risk minimize it and

minimize its impact specifically on us

our business and of course the assets of

the organization but the key here is

that they're software-based they're

implemented through the operating system

Andor an application both of which are

software and finally as a category

physical controls I often refer to these

as the guards guns and Gates

conversation when I talk to customers

and students these are controls that

manifest themselves in the physical

world we can touch them feel them

interact with them literally they are

guards they are guns they are Gates and

a variety of other physical measures

like doors and windows and closed

circuit TV monitoring that allow us to

understand our environment and in one

way or another monitor and constrain it

when we think about categories in other

words we think very broadly about

groupings of controls based on some sort

of approach or functionality as we then

get more granular more tactical in our

approach with regards to defining

controls we turn our attention to types

and types as you could see there are

seven of them here are going to allow us

to understand how we can make a very

specific choice to help us to impact and

minimize risk and in so doing allow us

to address risk so that we can push it

down as far as possible Trying to

minimize has that impact in the

organization and more broadly throughout

the organizational environment across

all the things we do and of course

across all the assets that we operate

with and so as we think about how we are

describing we want to make sure we

understand that categories are very

Broad and types are very specific that's

a really important takeaway from the

first question let's turn our attention

to why why do we want to use controls

why are they valuable to an organization

to you as an individual and by extension

to your organization well they give us

the ability as we were just talking

about let's draw our other hour here to

really highlight us on this to give us

this ability to do the

following right make sure that we try to

get rid of risk of it all possible even

draw a little line over here just to

make sure we see it's kind of xed out

now the reality is we're never going to

completely get rid of risk there's

always going to be some risk left which

is why I left the word risk right in the

middle of the diagram there but the

reality is we could certainly shrink

that Circle minimize that risk write it

much much smaller right so that we can

see that yeah it's a lot smaller than it

was and as a result lot less impactful

to us and controls are going to really

help us to get to that point and that's

the why let's talk now about the what

right specifically I've already defined

the idea of what the categories provide

for us in terms of groupings but I

haven't really touched on what the

individual types of controls are I want

to run them down for you quickly make

sure you have a high level understanding

of the seven distinct controls therefore

the seven choices we get to make with

regards to how we try to minimize that

risk down make it as small and tiny as

possible let's start at the top here

with directive we think about directive

controls we're think about controls that

provide guidance that are aligned

primarily with the administrative

category they're very likely policy

nature policy in nature policy driven

and or policy like and they're giving us

specific guidance aligning us with one

or more requirements that the

organization has fundamentally laid out

and made clear we need to follow and so

when we think about this we're thinking

about really controls that are going to

give guidance but guidance from a policy

driven standpoint or vantage point they

tell us to do something and they may or

may not tell us why it's important to do

that DET turn controls are going to

often be paired let's just make a little

connector here so we can see this

pairing are often going to be paired

with preventative controls people tend

to confuse the two want to make it clear

for you what they are but we should see

them as essentially two sides of the

same coin DET turn controls and the name

itself kind of implies what the

definition is DET turn controls are

meant to discourage Behavior you walk up

to a community or a house or an area

that's fenced off it has a fence it has

a gate has a guard has a big sign that

says do not trespass bad dog well that

hopefully is enough to deter you to make

you make smarter choices and not decide

to try to go in there when you don't

belong or aren't invited whereas a

preventative control is meant to stop

you if you really don't make good

choices because the deterrence was not

enough if we add to all those things I

just described a layer a series behind

that fence of guards that are standing

there waiting to capture you and escort

you off the property then that's going

to prevent you from getting inside and

as a result even if you make a bad

choice we're going to stop you and so

when we think about both deterrent and

we think about preventative controls we

think about ways in which we can either

encourage you to make good choices or

stop you if you make bad choices let's

talk about compensating controls

compensating controls these are designed

to step in and allow us to have a

secondary control a backup system if you

will that will prevent something bad

from happening because the primary

control that we were relying on for some

reason is not operable or has failed so

if you imagine for instance that we have

a computer that runs normally plugged

into our wall getting power from the

power grid from the electricity provider

the utility company and everything is

fine except when there's a storm and the

power is interrupted well if we had a

compensating control we would use a

backup battery solution what we call a

UPS an uninterruptible power supply

where we plug the computer instead of

into the wall into the battery box that

then is plugged into the wall during

normal operations we get power directly

from the utility company everything's

fine but when the power cuts off we

still have P we still have power from

the batteries and the computer could

still be run safely for period of time

shutting it down eliminating and

significantly reducing the likel here

we're going to damage the data or damage

the system by shutting it down uh heart

as we said right with no power all of a

sudden just turning it off so

compensating controls are meant to

offset the loss of a primary control and

the primary control could be one of the

other types whatever they are let's turn

our attention to detective controls well

detective controls are just like

detectives in real life they look for

Clues and they try to tell us and alert

us and show us that things are abnormal

and that we should pay attention to them

cuz likely something bad has happened or

is about to happen and we're seeing it

unfold in near real time so detective

controls just like Sherlock Holmes or

any detective that you like are good

sleuths they look for things and they

help us to uncover activity that's

probably going to be an issue for us and

then we want to take action to correct

corrective controls having just said the

word corrective controls are those

controls that allow us to take action

after something most likely has been

detected some bad thing has happened and

we want to put it right we want to get

back to normal we want to stop having

this issue and return operations the the

way they were before this occurred now

corrective and Recovery controls are

also usually grouped together by the way

because recovery controls are like an

extension of corrective controls but

they have more features more capability

more depth they're technically in other

words going to give us more options and

they're often used in combination with

corrective controls to again restore

systems and operations to normal after

some sort of bad event has occurred but

to do so with more capabilities more

often than not so these seven makeup our

types group together into one of three

categories and what we then have

ultimately is our ability to bring this

all together to shrink risk into a more

manageable size hopefully minimizing it

enough that the impact to our

organization is negligible or certainly

less than it would have been otherwise

could see the size difference there

hopefully indicates that and as a result

we live to fight another day I've been

Adam Gordon talking to you about

security controls on behalf of it pro TV

if you want to learn more about security

controls or any of the other thousands

of things we talk about and teach about

every day always want to invite you to

come and take a look over at it pro TV

spend some time with us myself and all

my fellow entertainers are always up for

opportunities to spend time with you

helping you to better understand your

world and making sure you have all the

knowledge you need to be successful I'll

be back soon with another conversation

but until I am I'll wish you happy

securing and I'll see you soon