Aka. countermeasures. Protective measures to reduce one or more vulnerabilities. Must know as much as threats to establish control for each.
Control mechanism changes based on kind of threats, control types and what they protects.
Effectiveness
Depends on a handful of properties.
Awareness
To what extent, are people aware of computer security.
Usage preference
To what extent, are people willing to use the control. Which depends on the efficiency (in terms of space, time, human activity).
Usage
Controls must be used properly and efficiently.
Periodic Review
Continuous assessment of control effectiveness.
Principle of Weakest Link
Security can be no stronger than the weakest link.
Types
Physical
Preventing the physical systems from being reached. Locking the server room, for example.
Technical
Can either be software or hardware.
Examples:
- Encryption
- Hardware Devices like encryption cards, locks, and firewalls.
- Software
Includes program security, access controls, and antivirus tools.
Administrative
Policies & Procedures
Organizational practices like password changes and regular audits.
Access Control
Policy defines who can access what resources and how.