Throughout this section, you might have heard me sing the word security control, so now you might
have question are what actually is a security control?
Why is he always saying security control?
But I don't know what security control is.
Well, don't worry.
In this lecture, we are going to discuss on security controls.
It's just a short video.
It's just a short lecture, I hope.
And I'm very sure that this lecture will clear all your doubts regarding a security control.
Now, security control is any process, policy procedure, guideline practice or organizational structure,
which can be administrative, technical management or legal in nature.
So controls for information security include any process, any policy, for example, access control
policy, mobile use policy, password, policy, duty, H.R. policy, anything.
It can be a procedure to assess the risk can be guidelines to set up infrastructure, a best practice
like ideal or an organizational structure which can be administrative.
Now, synonyms for controls can include major, it can be a countermeasure security device, etc. So
basically control is a measure that helps in modifying the risk or altering the risk, eliminating the
risk.
It's like basically you control it's the risk that can have an impact on the organization.
And what is a control objective?
A control objective is a statement.
What saying that what is to be achieved as a result of implementing a security control, so let's say
is a security control and B, the security objective.
So B says that B describes what things should be done after implementing E, for example, let's say
to Genndy is, let's say, a security control to manage the password, which is the password should
not be more than eight characters.
That is the security objective.
That is the B and A is password management, password management.
Security control is E.
So now when it comes to security controls, there are four major types of security controls.
The first one is technical control.
The second one is administrative control.
The third one is managerial control.
And the final one is legal control, not in technical control.
The controls are let me use my pen.
The first one is technical control.
Now, in this, the controls related to the use of technical measures or technologies such as firewalls,
alarm systems, surveillance cameras, intrusion detection systems, etc. Administrative controls can
be controls related to the organizational structure, such as segregation of duties, job rotations,
job descriptions, approval processes, etc..
Management controls can be the controls related to the management of people, including the training
and the coaching of employees.
Management review and audits and legal controls are the controls related to the applications of legislation,
regulatory requirements or compliance requirements.
Now, make sure that an administrative control is more related to the structure of the organization
as a whole without being applied to a specific person while manager controls can be applied to a specific
person.
Now, the differences between these types of controls are just for your understanding and you should
know it.
So, as I said earlier about the security objectives and security controls in this particular description,
in this particular video, we are going to see an example of security objectives and different security
controls.
So now this is the security control that you should be placing in an organization that is, let's take
an example to ensure the correct and secure operations of information processing facilities so security
control can be documented, operational procedures, change management, Barredo through DOD, could
a growing capacity, management and separation of development and testing and operational environments.
So if capacity management can be managed, that is the control to ensure the correct and secure operations
of information processing facilities.
So I hope you have an idea of security objective and security control, so this right around here,
as you can see, this is the security objective that is to ensure what is our objective.
Our objective is to ensure and secure operations of information processing facilities in order to achieve
these objectives.
These security controls are implemented so that this objective can be achieved.
Now, that is it for this lecture.
In this lecture we have seen about the security controls, why do we need security controls and relationship
between security objectives and security controls in the next lecture?
We'll talk about the classes of security controls, which are very important.
I'll see you in the next lecture.