Every business has valuable IT assets such as computers, networks, and data. These organizations should conduct their own IT security audits for protecting their IT assets. Conducting their own IT security audits will give a clear picture of the security risks they face and how to best deal with those threats. Whenever organizations have to face some loss, compromise or when there is a security breach, it is because their information system is lacking required IT controls. Security controls are measures taken to protect an enterprise information system from potential attacks against the confidentiality, integrity, and availability of the information system. Security Controls can be categorized in three ways:
Proactive/Preventive Controls
Preventive controls proactively define and enforce acceptable behaviors. Preventive security controls are put into place to prevent intentional or unintentional disclosure, modification, or destruction of sensitive information. Examples: Policy, Firewall.
Detective Controls
Detective controls constantly monitor all activities happening in the Information System of the organization. They detect and report an undesired or unauthorized event (attempted or otherwise). Detective security controls are invoked after the undesirable event has happened. Examples: Log monitoring and review, File integrity checkers, System audit.
Reactive/Corrective Controls
Reactive or corrective controls typically start work, once the alarm has been raised by a detective control. They respond to and fix an incident once it has occurred. They also try to limit or reduce further damage from an attack.
Examples: Cleaning system infected with a virus, Placing firewall rules to block an attacking IP address
Conclusion:
These 3 controls are the ways of mitigating the risk to the organizational information system. However as security threats are always change, keeping your company safe requires that you continually assess new threats and revisit your response to old ones.
Security controls are selected and applied based on a risk assessment of the information system. The risk assessment process identifies system threats and vulnerabilities, and then security controls are selected to mitigate the risk.
Be the first to rate this post
- Currently 0/5 Stars.
- 1
- 2
- 3
- 4
- 5