Full transcript
0:01If you've spent any amount of time in IT security,
0:04you know there are many different security risks
0:06that you need to prepare for.
0:08The attackers are looking for different ways
0:11to gain access to our systems.
0:12And we need to find different ways to prevent them
0:15from getting that access.
0:17But of course, we're not just protecting data.
0:19We're also protecting physical systems, buildings, people,
0:23and everything in our organization.
0:26In this video, we'll look at different security controls
0:29and how they can be used to prevent events from occurring
0:32in the first place.
0:33We can minimize the impact of events
0:35that ultimately do occur.
0:37And in many cases, we can limit the damage
0:40if someone does find a way into our computing environment.
0:44Let's look at some very broad categories
0:47of security controls.
0:48The first category we'll look at are technical controls.
0:52These are controls that we implement using
0:54some type of technical system.
0:56So if you're someone who is managing an operating system,
1:00you might set up policies and procedures
1:02within the operating system that would allow or disallow
1:06different functions from occurring.
1:07We can also put firewalls, antivirus,
1:10and other types of software into this category
1:13of technical controls.
1:15As a security administrator, you'll
1:17also want to create a series of policies that explain to people
1:21the best way to manage their computers, their data,
1:24or their other systems.
1:25We refer to these as managerial controls.
1:28So if you are creating a series of policies and procedures
1:32or you're creating an official security policy documentation,
1:35you'll often put these managerial controls inside
1:39of your security policies.
1:40You might also see these managerial controls implemented
1:43into day-to-day processes as part of your standard operating
1:47procedures.
1:49Another important control category
1:50are the operational controls.
1:52Unlike using technology to manage these controls,
1:56operational controls are using people
1:58to be able to set these controls.
2:00So if you have security guards at your place of work,
2:02you're doing monthly lunch and learns,
2:04or you have some type of posters or awareness program
2:07at work to help explain the best practices for IT security,
2:12then you can put these into the category
2:14of operational controls.
2:16And the last category that we have are physical controls.
2:19As the name implies, these are controls
2:22that would limit someone's physical access to a building,
2:25a room, or a device.
2:27This might be something like a guard shack.
2:29So they can check everyone coming into a particular area.
2:32Maybe there are fences and locks to keep people out.
2:35Or maybe use badge readers to limit the access
2:39into certain areas within your building.
2:41So in this video, we'll focus on these four categories
2:45of controls-- the technical, managerial,
2:48operational, and physical.
2:49And in this video, we'll look at a number of different control
2:53types and determine where we would fit certain control
2:56types into certain categories.
2:59The first control type we'll look at
3:00is a preventive control type.
3:02This is a control type that limits someone access
3:05to a particular resource.
3:07You can think of this as something
3:09like a firewall rule, which would prevent somebody
3:11from gaining access to a particular area
3:14of your network.
3:15Or it may be something that's more tangible, such as a guard
3:18shack checking everyone's identification
3:20as they come into your facility.
3:23A good way to test yourself with these different control types
3:25is to determine what category will a certain type fit into.
3:30So when we deal with preventive control types,
3:32we can look at firewall rules.
3:34And since those are handled at a technical level,
3:36then those would fit into the technical category.
3:39As we hire people, we may want to set a certain type of policy
3:43for onboarding.
3:44And those would be policies set as part
3:47of a managerial category.
3:48We've already mentioned a guard shack
3:50checking everyone's identification.
3:52And since that's done by a person,
3:54we can fit that into an operational category.
3:57And lastly, we have door locks, which
3:59are physical devices preventing access to a room.
4:02So that would fit into the physical category.
4:05Another important control type is a deterrent.
4:08And although a deterrent may not prevent someone
4:10from accessing a resource, it may give them a discouragement
4:14or have them think twice about the attack
4:17that they're planning.
4:18For example, when you start an application,
4:20there may be a splash screen that
4:21provides security information and restricts
4:24people who are not authorized from gaining access
4:27to that system.
4:28Or there might be the threat of a demotion or a dismissal
4:31if somebody gains access to data that they should not
4:34be accessing.
4:35There might also be a front reception desk
4:37greeting everyone who walks in or warning signs telling people
4:41that if they gain access to this facility
4:43that there would be consequences.
4:45These fit perfectly into our four categories.
4:48A splash screen is a deterrent that fits
4:50into the technical category.
4:52A demotion is a managerial category.
4:55The reception desk fits into the operational category.
4:58And the warning signs are a physical deterrent.
5:02A detective control type can identify and, in some cases,
5:06warn us when a particular breach has occurred.
5:09This may not prevent access.
5:11But it would give us a warning and log information
5:14about that particular attack.
5:16An example of a detective control type
5:19may be a process of collecting, reviewing,
5:21and going through system logs.
5:23Or you may be reviewing log-in reports about who's
5:26gained access to your systems.
5:28There might be someone patrolling the property,
5:30looking for cases where someone might
5:32have broken into your facility.
5:34And you might have motion detectors
5:35so that you're automatically notified
5:37if something is moving in an area
5:40where normally there should be no motion.
5:42The system logs that are detailing everything that's
5:45going on in your systems would fit
5:47into the technical category.
5:49Someone reviewing log-in reports every day or every week
5:52would fit into the managerial category.
5:55Someone patrolling the property would
5:57be an operational category.
5:59And then the motion detectors provide us
6:01with a physical category.
6:03If there is a notification that someone has breached a system
6:07or gained access into a certain area of your business,
6:11then you want to apply a corrective security control.
6:14A corrective security control is something
6:16that occurs after the event has been detected.
6:19This is sometimes able to reverse the impact
6:22of that particular event.
6:24Or you may be able to continue operating
6:26with your business with minimal downtime,
6:29thanks to these corrective controls.
6:31For example, if a computer has been infected with ransomware
6:35and it has encrypted everything on that system
6:37and made all of the data inaccessible,
6:39you can simply erase everything on that computer
6:42and restore it back to a known good system using your backups.
6:46You might also want to create policies so
6:48that if there are security issues
6:50or something unusual that you see happen,
6:53then those would be rolled up into an alert
6:56or some type of notification.
6:58And if you find that someone has jumped your fence
7:00or they've tried to get in through a door
7:01in your building, you may need to contact law enforcement
7:04to be able to correct that particular incident.
7:07And if something is caught on fire,
7:09you can grab a fire extinguisher and make sure
7:11that that fire doesn't spread any further, thereby correcting
7:15that particular event.
7:17And as you might expect, those are four events
7:20that certainly fits into the four categories that we have.
7:23For example, recovering from a backup
7:25would be a technical category.
7:27Being able to have policies for reporting issues
7:30when they occur would be in the managerial category.
7:33Contacting authorities for some type of legal issue
7:36would be an operational category.
7:38And your fire extinguisher is a physical category.
7:42You might also find yourself in a situation
7:45where a security event has occurred,
7:47but you don't have the resources or means
7:49to be able to reverse what that particular event has caused.
7:53In those cases, you may want to use a compensating control
7:56type, which provides you with using other means in a way
8:00to control that particular security event.
8:02This may be something you use on a temporary basis
8:05until you're able to put together a plan to resolve
8:08the overall security incident.
8:10For example, you might have an application
8:12that is important for your organization.
8:14But the application developer has told you
8:16that they've identified a significant security
8:18vulnerability in that software.
8:20Since the application developer is
8:22going to provide you with a patch sometime in the future,
8:25you may want to set some type of firewall rule today that
8:29would prevent somebody from exploiting
8:31that particular vulnerability.
8:33Or this might be a case where you
8:34can separate different duties between different individuals
8:38and limit the scope of any type of security concern.
8:41Or you might have multiple security guards
8:43all working at the same time to make sure
8:46that no single security guard has
8:48complete access to everything in your environment.
8:51And if you lose power in your building,
8:53you might want to have a generator so that while you're
8:56waiting for main power to be restored,
8:58you can compensate by turning on your generator.
9:01Those are our four different categories
9:03of a compensating control.
9:05We have a technical category of blocking that traffic
9:08instead of patching the application.
9:10There may be a separation of duties for the people
9:12that work in your organization.
9:14And that fits into the managerial category.
9:16You might require multiple security staff
9:19working simultaneously.
9:20And that would be the operational category.
9:23And lastly, having a power generator
9:25to compensate for a power outage fits
9:27into the physical category.
9:29The last control type we'll look at is a directive control type.
9:34This is a relatively weak security control
9:36because it is one where you are directing someone
9:39to do something more secure rather than less secure.
9:43For example, you may require everyone
9:45to store sensitive information into a protected and encrypted
9:49folder on their system.
9:51This requires the user to make a decision
9:53about what data may be sensitive and what
9:55data may be nonsensitive.
9:57And then they are directed to store the sensitive information
10:00in the protected folder.
10:02As part of our security policies,
10:03we may want to add compliance policies and procedures so
10:06that everyone understands the proper processes to use
10:10for security in your environment.
10:12You might also train users on what the proper security
10:15policies might be.
10:16And another example of a directive control
10:19may be a sign that you put on a door that says
10:21"authorized personnel only."
10:23There might not be a lock on the door.
10:25But the sign saying "authorized personnel only"
10:28directs people to either enter or not
10:31enter that particular door.
10:33So to summarize these, our file storage policies
10:36will direct people to this technical category.
10:40A compliance policy fits into a managerial category.
10:43Someone performing a security policy training course
10:47would be a directive control type fitting
10:49into the operational category.
10:51And a sign on a door that says "authorized personnel only"
10:54fits into the physical category.
10:57The examples I provided for the different security
10:59controls and the categories where they fit
11:02are simply one single example.
11:04And you can probably think of a number of different examples
11:07that you could fit into any of those squares in our matrix.
11:11You could probably also think of different security controls
11:14that might fit into a different category of control
11:17or a different type of control.
11:19You might also find as our technology changes
11:22and our security processes evolve
11:24that there might be new control types that we
11:26could fit into our chart.
11:28And of course, not everybody uses the same security
11:31controls.
11:32So the ones that you use in your organization
11:34may be very different than someone else's organization.