Information Security and Cybersecurity typically fall under Business Risk Management
Security Controls provide the CIA-N properties [Confidentiality, Integrity, Availability, Non-Repudiation] to systems and assets.
Managerial: System Oversight
Operational: Implemented by Personnel, e.g. guards, workforce training
Technical: Implemented as a System, e.g. Firewall, Anti-virus, OS access control
Physical: Alarms, gateways, locks, lighting, cameras, deterrents and detectors
Controls intended to reduce the probability that a given attack-attempt will succeed. These operate in the background before attacks occur.
Access Control Lists in Firewalls and file system managers are Preventive because they institute broad permissions that can thwart account spoofing.
Anti-Malware is Preventive because it blocks the action of malicious processes and suspicious internet traffic.
Controls that identify and document intrusions in a system.
These do not necessarily prevent anything, but generally log traffic for later observation ans analysis.
Controls that reduce or revert the effects of a security policy violation.
Post-event action includes Backup & Restoration systems, Patch-managers and update-reversion to eliminate vulnerabilities.
Rule-Enforcement Policies, industry standards, standard-operating-procedures [SOPs], e.g. Contract Terms, Consequences of Breach, Training & Awareness programs.
Mostly psychological: Signs, Lighting, Legal Penalties
Substitute for a principal control, as recommended by a standard, which provides equal or superior function but uses different methods or technology.
Policy implementation can differ by business-type or by institution.
Each business should have the same interest in ensuring the digital security of its employees, physical assets, and data.
To have a strong security posture, a business must implement security policies with framework-based security controls.
CIO: Chief Information Officer: Responsible for overall IT department functions.
Similarly a CTO or Chief Technology Officer may have more specific responsibilities, including to ensure the safe and responsible use of new technology.
CSO: Chief Security Officer: Responsible for overall security department. Also, CISO - Chief Information Security Officer.
Managers are responsible for specific domains, i.e. building controls, networks, web-services, accounting.
Technical and Specialist staff: Implement, maintain, and monitor security policy. These include System-Administrators, Network Administrators, and Security Administrators.
Non-technical staff are responsible for Policy Compliance.
Exeternal responsibility lies with Directors, Owners, etc.
Note: NIST categorizes tasks and roles here:
Network Application Design & Implementation [Socket Programming], Procurement, Human Resource Management
Risk Assessment & Testing
Procurement & Installation
Access Control Administration
Monitoring Logs & Privilege Status
Incident-Response & Reporting
Business-Continuity & Recovery-Planning
Participation in Training & Education Programs
Security Operations Centers [SOCs] Monitor & Protect assets.
SOCs are usually employed by larger organizations such as government or healthcare.
DevOps refers to Development & Operations
This includes collaboration between developers & system administrators.
DevOps is an orchestrated environment, which is used to build, test, and release software faster and more reliably.
DevSecOps includes Security personnel & activities
Security considerations must begin at the requirement-elicitation and planning phase of software development, NOT as an afterthought.
Security Operations can also be considered development projects
Security tools can be automated [with Socket Programming]
Thus, SecOps must have the expertise of Developers
CIRT: Computer [Security] Incident Response Team
This team is a point-of-contact for notification on security incidents.
This function CAN be handled by the Security Operations Center, or may be an independent business unit.
Up Next: Threat Actors [Link when complete]