Security controls are safeguards or countermeasure

Countermeasure (computer)

In Computer Security a countermeasure is an action, device, procedure, or technique that reduces a threat, a vulnerability, or an attack by eliminating or preventing it, by minimizing the harm it can cause, or by discovering and reporting it so that corrective action can be taken.The definition is...

s to avoid, counteract or minimize security

Security risk

Security Risk describes employing the concept of risk to the security risk management paradigm to make a particular determination of security orientated events.According to CNSS Instruction No...

 risks.

To help review or design security controls, they can be classified by several criteria, for example according to the time that they act, relative to a security incident:

• Before the event, preventive controls are intended to prevent an incident from occurring e.g. by locking out unauthorized intruders;
• During the event, detective controls are intended to identify and characterize an incident in progress e.g. by sounding the intruder alarm and alerting the security guards or police;
• After the event, corrective controls are intended to limit the extent of any damage caused by the incident e.g. by recovering the organization to normal working status as efficiently as possible.

(Some security professionals would add further categories such as deterrent controls and compensation. Others argue that these are subsidiary categories. This is simply a matter of semantics.)

Security controls can also be categorized according to their nature, for example:

• Physical controls e.g. fences, doors, locks and fire extinguishers;
• Procedural controls e.g. incident response processes, management oversight, security awareness and training;
• Technical controls e.g. user authentication (login) and logical access controls, antivirus software, firewalls;
• Legal and regulatory or compliance controls e.g. privacy laws, policies and clauses.

A similar categorization distinguishes control involving people, technology and operations/processes.

Information security controls protect the confidentiality, integrity and/or availability of information (the so-called CIA Triad). Again, some would add further categories such as non-repudiation and accountability, depending on how narrowly or broadly the CIA Triad is defined.

Risk-aware organizations may choose proactively to specify, design, implement, operate and maintain their security controls, usually by assessing the risks and implementing a comprehensive security management framework such as ISO/IEC 27002

ISO/IEC 27002

ISO/IEC 27002 is an information security standard published by the International Organization for Standardization and by the International Electrotechnical Commission , entitled Information technology - Security techniques - Code of practice for information security management.ISO/IEC 27002:2005...

, the Information Security Forum's Standard of Good Practice for Information Security and NIST SP 800-53 (more below). Organizations may also opt to demonstrate the adequacy of their information security controls by being independently assessed against certification standards such as ISO/IEC 27001

ISO/IEC 27001

ISO/IEC 27001, part of the growing ISO/IEC 27000 family of standards, is an Information Security Management System standard published in October 2005 by the International Organization for Standardization and the International Electrotechnical Commission...

.

In telecommunications, security controls are defined as Security services

Security service (telecommunication)

Security service is a service, provided by a layer of communicating open systems, which ensures adequate security of the systems or of data transfers as defined by ITU-T X.800 Recommendation....

 as part of OSI Reference model

OSI model

The Open Systems Interconnection model is a product of the Open Systems Interconnection effort at the International Organization for Standardization. It is a prescription of characterizing and standardizing the functions of a communications system in terms of abstraction layers. Similar...

 by ITU-T X.800 Recommendation.
X.800 and ISO ISO 7498-2 (Information processing systems – Open systems interconnection – Basic Reference Model – Part 2: Security architecture are technically aligned.

Information security standards and control frameworks

Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. Some of the most well known are outlined below.

International information security standards

ISO/IEC 27001

ISO/IEC 27001

ISO/IEC 27001, part of the growing ISO/IEC 27000 family of standards, is an Information Security Management System standard published in October 2005 by the International Organization for Standardization and the International Electrotechnical Commission...

1. Risk assessment and treatment - analysis of the organization's information security risks
2. Security policy - management direction
3. Organization of information security - governance of information security
4. Asset management - inventory and classification of information assets
5. Human resources security - security aspects for employees joining, moving and leaving an organization
6. Physical and environmental security - protection of the computer facilities
7. Communications and operations management - management of technical security controls in systems and networks
8. Access control - restriction of access rights to networks, systems, applications, functions and data
9. Information systems acquisition, development and maintenance - building security into applications
10. Information security incident management - anticipating and responding appropriately to information security breaches
11. Business continuity management - protecting, maintaining and recovering business-critical processes and systems
12. Compliance - ensuring conformance with information security policies, standards, laws and regulations

U.S. Federal Government information security standards

From NIST Special Publication SP 800-53 revision 3.

1. AC Access Control
2. AT Awareness and Training
3. AU Audit and Accountability
4. CA Certification, Accreditation, and Security Assessments
5. CM Configuration Management
6. CP Contingency Planning
7. IA Identification and Authentication
8. IR Incident Response
9. MA Maintenance
10. MP Media Protection
11. PE Physical and Environmental Protection
12. PL Planning
13. PS Personnel Security
14. RA Risk Assessment
15. SA System and Services Acquisition
16. SC System and Communications Protection
17. SI System and Information Integrity
18. PM Program Management

U.S. Department of Defense

United States Department of Defense

The United States Department of Defense is the U.S...

 information security standards

From DoD Instruction 8500.2 http://www.dtic.mil/whs/directives/corres/pdf/850002p.pdf there are 8 Information Assurance

Information Assurance

Information assurance is the practice of managing risks related to the use, processing, storage, and transmission of information or data and the systems and processes used for those purposes...

 (IA) areas and the controls are referred to as IA controls.

1. DC Security Design & Configuration
2. IA Identification and Authentication
3. EC Enclave and Computing Environment
4. EB Enclave Boundary Defense
5. PE Physical and Environmental
6. PR Personnel
7. CO Continuity
8. VI Vulnerability and Incident Management

DoD assigns the IA control per CIA Triad leg.

See also

• Access control
  Access control
  Access control refers to exerting control over who can interact with a resource. Often but not always, this involves an authority, who does the controlling. The resource can be a given building, group of buildings, or computer-based information system...
  
  
• countermeasure
  Countermeasure (computer)
  In Computer Security a countermeasure is an action, device, procedure, or technique that reduces a threat, a vulnerability, or an attack by eliminating or preventing it, by minimizing the harm it can cause, or by discovering and reporting it so that corrective action can be taken.The definition is...
  
  
• Environmental design
  Environmental design
  Environmental design is the process of addressing surrounding environmental parameters when devising plans, programs, policies, buildings, or products...
  
  
• Information security
  Information security
  Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction....
  
  
• OSI Reference Model
  OSI model
  The Open Systems Interconnection model is a product of the Open Systems Interconnection effort at the International Organization for Standardization. It is a prescription of characterizing and standardizing the functions of a communications system in terms of abstraction layers. Similar...
  
  
• Physical Security
  Physical security
  Physical security describes measures that are designed to deny access to unauthorized personnel from physically accessing a building, facility, resource, or stored information; and guidance on how to design structures to resist potentially hostile acts...
  
  
• Risk
  Risk
  Risk is the potential that a chosen action or activity will lead to a loss . The notion implies that a choice having an influence on the outcome exists . Potential losses themselves may also be called "risks"...
  
  
• Security
  Security
  Security is the degree of protection against danger, damage, loss, and crime. Security as a form of protection are structures and processes that provide or improve security as a condition. The Institute for Security and Open Methodologies in the OSSTMM 3 defines security as "a form of protection...
  
  
• Security engineering
  Security engineering
  Security engineering is a specialized field of engineering that focuses on the security aspects in the design of systems that need to be able to deal robustly with possible sources of disruption, ranging from natural disasters to malicious acts...
  
  
• Security management
  Security management
  Security Management is a broad field of management related to asset management, physical security and human resource safety functions. It entails the identification of an organization's information assets and the development, documentation and implementation of policies, standards, procedures and...
  
  
• Security services
  Security service (telecommunication)
  Security service is a service, provided by a layer of communicating open systems, which ensures adequate security of the systems or of data transfers as defined by ITU-T X.800 Recommendation....