Section 2.13 Security control categories

Question 1

4 broad categories

Security Control categories

TMOP

Answer 1

1. Technical controls
2. Managerial/Administrative controls
3. Operational controls
4. Physical controls

Security is about the layers of protection that combine to form a robust security posture

Question 2

1

Technical Controls

Answer 2

Technologies, hardware and software mechanisms that are implemented to manage and reduce risks

e.g installing anti-virus software which automatially detects malicious files when downloaded

e.g Firewalls. Encryption processes, Intrusion Detection system

Question 3

2

Managerial/Administrative controls

PL&GO

Answer 3

Strategic planning and governance side of security

e.g If an organisation wants to adopt cloud storage solution the managerial team will conduct a risk assessment before decision.

e.g Security policies, training programs, incident response strategies

Question 4

3

Operational controls

Answer 4

Protect data on a day to day basis. These are mainly governed by internal processes and human actions

e.g if your organisation wants you to change your password every 90 days - this is considered operational control

e.g Back up procedures. Account reviews, user training programs

Question 5

4

Physical controls

Answer 5

Tangible, real world measures taken to protect assests

e.g Security cameras to prevent unauthorised physical access

e.g Shredding sensitive documents, security guards, locking the doors