Security controls are safeguards or countermeasures to avoid, detect, counteract, or minimize securityrisks to physical property, information, computer systems, or other assets. In the field of information security, such controls protect the confidentiality, integrity and availability of information. Systems of controls can be referred to as frameworks or standards. Frameworks can enable an organization to manage security controls across different types of assets with consistency.
Types of security controls
Security controls can be classified by several criteria. For example, according to the time that they act, relative to a security incident:
Before the event, preventive controls are intended to prevent an incident from occurring e.g. by locking out unauthorized intruders;
During the event, detective controls are intended to identify and characterize an incident in progress e.g. by sounding the intruder alarm and alerting the security guards or police;
After the event, corrective controls are intended to limit the extent of any damage caused by the incident e.g. by recovering the organization to normal working status as efficiently as possible.
They can also be classified according to their nature, for example:
Physical controlse.g. fences, doors, locks and fire extinguishers;
Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. Some of the most well known are outlined below.
The Federal Information Processing Standards apply to all US government agencies. However, certain national security systems under the purview of the Committee on National Security Systems are managed outside these standards. Federal information Processing Standard 200, "Minimum Security Requirements for Federal Information and Information Systems", specifies the minimum security controls for federal information systems and the processes by which risk-based selection of security controls occurs. The catalog of minimum security controls is found in NIST Special Publication . FIPS 200 identifies 17 broad control families:
A maturity based framework divided into five functional areas and approximately 100 individual controls in its "core."
'''NIST SP-800-53'''
A database of nearly one thousand technical controls grouped into families and cross references.
Starting with Revision 3 of 800-53, Program Management controls were identified. These controls are independent of the system controls, but are necessary for an effective security program.
Starting with Revision 4 of 800-53, eight families of privacy controls were identified to align the security controls with the privacy expectations of federal law.
Starting with Revision 5 of 800-53, the controls also address data privacy as defined by the NIST Data Privacy Framework.
These are technically aligned. This model is widely recognized.
Data Liability (legal, regulatory, compliance)
The intersection of security risk and laws that set standards of care is where data liability are defined. A handful of databases are emerging to help risk managers research laws that define liability at the country, province/state, and local levels. In these control sets, compliance with relevant laws are the actual risk mitigators.
Perkins Coie Security Breach Notification Chart: A set of articles that define data breach notification requirements among US states.
NCSL Security Breach Notification Laws: A list of US state statutes that define data breach notification requirements.
ts jurisdiction: A commercial cybersecurity research platform with coverage of 380+ US State & Federal laws that impact cybersecurity before and after a breach. ts jurisdiction also maps to the NIST Cybersecurity Framework.
Business control frameworks
There are a wide range of frameworks and standards looking at internal business, and inter-business controls, including:
