This article may be confusing or unclear to readers. (January 2012) (Learn how and when to remove this template message)
They can be classified by several criteria. For example, according to the time that they act, relative to a security incident:
- Before the event, preventive controls are intended to prevent an incident from occurring e.g. by locking out unauthorized intruders;
- During the event, detective controls are intended to identify and characterize an incident in progress e.g. by sounding the intruder alarm and alerting the security guards or police;
- After the event, corrective controls are intended to limit the extent of any damage caused by the incident e.g. by recovering the organization to normal working status as efficiently as possible.
According to their nature, for example:
- Physical controls e.g. fences, doors, locks and fire extinguishers;
- Procedural controls e.g. incident response processes, management oversight, security awareness and training;
- Technical controls e.g. user authentication (login) and logical access controls, antivirus software, firewalls;
- Legal and regulatory or compliance controls e.g. privacy laws, policies and clauses.
A similar categorization distinguishes control involving people, technology and operations/processes.
Systems of controls can be referred to as frameworks or standards. Frameworks can enable an organization to manage security controls across different types of assets with consistency.
Information security standards and control frameworks
Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. Some of the most well known are outlined below.
International information security standards
ISO/IEC 27001 specifies 114 controls in 14 groups:
- A.5: Information security policies
- A.6: How information security is organised
- A.7: Human resources security - controls that are applied before, during, or after employment.
- A.8: Asset management
- A.9: Access controls and managing user access
- A.10: Cryptographic technology
- A.11: Physical security of the organisation's sites and equipment
- A.12: Operational security
- A.13: Secure communications and data transfer
- A.14: Secure acquisition, development, and support of information systems
- A.15: Security for suppliers and third parties
- A.16: Incident management
- A.17: Business continuity/disaster recovery (to the extent that it affects information security)
- A.18: Compliance - with internal requirements, such as policies, and with external requirements, such as laws.
U.S. Federal Government information security standards
The Federal Information Processing Standards (FIPS) apply to all US government agencies. However, certain national security systems under the purview of the Committee on National Security Systems are managed outside these standards.
Federal information Processing Standard 200 (FIPS 200), "Minimum Security Requirements for Federal Information and Information Systems", specifies the minimum security controls for federal information systems and the processes by which risk-based selection of security controls occurs. The catalog of minimum security controls is found in NIST Special Publication SP 800-53.
FIPS 200 identifies 17 broad control families:
- AC Access Control.
- AT Awareness and Training.
- AU Audit and Accountability.
- CA Security Assessment and Authorization. (historical abbreviation)
- CM Configuration Management.
- CP Contingency Planning.
- IA Identification and Authentication.
- IR Incident Response.
- MA Maintenance.
- MP Media Protection.
- PE Physical and Environmental Protection.
- PL Planning.
- PS Personnel Security.
- RA Risk Assessment.
- SA System and Services Acquisition.
- SC System and Communications Protection.
- SI System and Information Integrity.
Starting with Revision 3 of 800-53, Program Management controls were identified. These controls are independent of the system controls, but are necessary for an effective security program.
Starting with Revision 4 of 800-53, eight families of privacy controls were identified to align the security controls with the privacy expectations of federal law.
- ITU-T X.800 Recommendation.
- ISO ISO 7498-2
Business control frameworks
There are a wide range of frameworks and standards looking at internal business, and inter-business controls, including:
- SSAE 16
- ISAE 3402
- Payment Card Industry Data Security Standard
- Health Insurance Portability and Accountability Act
- Access control
- Environmental design
- Information security
- OSI Reference Model
- Physical Security
- Security engineering
- Security management
- Security services
- X.800 : Security architecture for Open Systems Interconnection for CCITT applications
- ISO 7498-2 (Information processing systems – Open systems interconnection – Basic Reference Model – Part 2: Security architecture)
- William Stallings Crittografia e sicurezza delle reti Seconda edizione ISBN 88-386-6377-7 Traduzione Italiana a cura di Luca Salgarelli di Cryptography and Network security 4 edition Pearson 2006
- Securing information and communications systems: principles, technologies, and applications Steven Furnell, Sokratis Katsikas, Javier Lopez, Artech House, 2008 - 362 pages