Security Controls

Sensitive data should be protected based on the potential impact of a loss of confidentiality, integrity, or availability.  Protection measures (otherwise known as security controls) tend to fall into two categories.  First, security weaknesses in the system need to be resolved.  For example, if a system has a known vulnerability that attackers could exploit, the system should be patched so that the vulnerability is removed or mitigated.  Second, the system should offer only the required functionality to each authorized user, so that no one can use functions that are not necessary.  This principle is known as least privilege.  Limiting functionality and resolving security weaknesses have a common goal: give attackers as few opportunities as possible to breach a system.

There are three types of security controls, as follows:

• Management controls: The security controls that focus on the management of risk and the management of information system security.
• Operational controls: The security controls that are primarily implemented and executed by people (as opposed to systems).
• Technical controls: The security controls that are primarily implemented and executed by the system through the system's hardware, software, or firmware.

All three types of controls are necessary for robust security. For example, a security policy is a management control, but its security requirements are implemented by people (operational controls) and systems (technical controls). Think of phishing attacks. An organization may have an acceptable use policy that specifies the conduct of users, including not visiting malicious websites. Security controls to help thwart phishing, besides the management control of the acceptable use policy itself, include operational controls, such as training users not to fall for phishing scams, and technical controls that monitor emails and web site usage for signs of phishing activity.

A common problem with security controls is that they often make systems less convenient or more difficult to use.  When usability is an issue, many users will attempt to circumvent security controls; for example, if passwords must be long and complex, users may write them down.  Balancing security, functionality, and usability is often a challenge.  The goal should be to strike a proper balance: provide a reasonably secure solution while offering the functionality and usability that users require.

Another fundamental principle with security controls is using multiple layers of security—defense in depth.  For example, sensitive data on a server may be protected from external attack by several controls, including a network-based firewall, a host-based firewall, and OS patching.  The motivation for having multiple layers is that if one layer fails or otherwise cannot counteract a certain threat, other layers might prevent the threat from successfully breaching the system.  A combination of network-based and host-based controls is generally most effective at providing consistent protection.