After completing this tutorial, you should be able to:
In Tutorial 6.5, we explored how policies, standards, procedures, and guidelines translate governance into actionable requirements. But policies alone do not protect assets—they must be implemented through security controls. A security control is a safeguard or countermeasure designed to reduce risk by preventing, detecting, or correcting security incidents. Controls are the practical manifestation of security strategy.
This tutorial provides a comprehensive examination of security controls. We begin by classifying controls into three broad categories: administrative (or management), technical (or logical), and physical. We then examine the functions controls serve: preventive, detective, corrective, deterrent, recovery, and compensating. Understanding these classifications is essential for selecting and implementing effective measures.
We will then explore major control frameworks—structured catalogs of controls that provide a common language and best-practice guidance. These include ISO/IEC 27001:2022 Annex A, NIST SP 800-53, the CIS Controls, and COBIT. These frameworks are invaluable for designing comprehensive security programs and demonstrating due diligence.
We will also discuss the process of selecting and implementing controls, balancing cost, risk reduction, and operational impact. Finally, we examine how to evaluate controls through testing, monitoring, and auditing to ensure they remain effective over time. Through case studies and practical exercises, you will gain the skills to design, implement, and manage a control set that aligns with organizational objectives and regulatory requirements.
A security control is any measure, procedure, or mechanism that is implemented to reduce the likelihood or impact of a security incident, or to detect and respond to incidents. Controls are the means by which an organization enforces its security policies and manages risk. They can be as simple as a lock on a door or as complex as a security information and event management (SIEM) system.
The primary purposes of controls are:
Controls are often organized in a layered, defense-in-depth approach. No single control is perfect; multiple overlapping controls provide redundancy and resilience. The following diagram illustrates a common layered approach:
┌─────────────────────────────────────────────────────────────────────┐
│ DEFENSE IN DEPTH LAYERS │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ ┌───────────────────────────────────────────────────────────────┐ │
│ │ POLICIES & PROCEDURES │ │
│ │ (Administrative controls: rules, training, awareness) │ │
│ └───────────────────────────────────────────────────────────────┘ │
│ │ │
│ ┌───────────────────────────────────────────────────────────────┐ │
│ │ TECHNICAL CONTROLS (Logical) │ │
│ │ (Firewalls, encryption, IDS/IPS, access controls) │ │
│ └───────────────────────────────────────────────────────────────┘ │
│ │ │
│ ┌───────────────────────────────────────────────────────────────┐ │
│ │ PHYSICAL CONTROLS │ │
│ │ (Locks, guards, surveillance, environmental controls) │ │
│ └───────────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────┘
Each layer addresses different types of threats and vulnerabilities. A comprehensive security program employs controls at all layers.
Administrative controls are policies, procedures, and management practices that define how security is implemented and managed. They are often called "management controls" because they involve planning, organizing, and leading security efforts. These controls are typically implemented through documentation, training, and oversight.
Examples:
Administrative controls are the foundation of a security program. They establish expectations, assign responsibilities, and provide the framework for other controls.
Technical controls are safeguards that use technology to protect information systems and data. They are often implemented in hardware, software, or firmware. Technical controls are typically automated and provide consistent, repeatable enforcement of security policies.
Examples:
Technical controls are essential for protecting against technical threats, but they must be properly configured and maintained to be effective.
Physical controls are measures that protect physical assets, facilities, and personnel. They prevent unauthorized physical access, protect against environmental hazards, and ensure the physical security of information systems.
Examples:
Physical controls are often overlooked but are critical because they protect the underlying infrastructure that supports technical and administrative controls.
| Category | Primary Focus | Implementation | Examples |
|---|---|---|---|
| Administrative | People, processes, and management | Policies, procedures, training | Security policy, awareness training, incident response plan |
| Technical | Systems, networks, data | Hardware, software, firmware | Firewalls, encryption, access control lists, IDS |
| Physical | Facilities, equipment, personnel | Physical barriers, locks, environmental systems | Locks, guards, CCTV, fire suppression |
Beyond categorizing by type, controls can be classified by their function —the role they play in the security lifecycle. The most common functions are:
Preventive controls aim to stop security incidents before they happen. They are the first line of defense and are generally the most cost-effective because they avoid the costs of response and recovery.
Examples:
Detective controls identify that an incident has occurred or is occurring. They provide visibility into security events and enable timely response. While they do not prevent incidents, they are critical for minimizing damage and improving future prevention.
Examples:
Corrective controls remediate the impact of an incident and return the system to a secure state. They are activated after detection and aim to minimize damage, restore operations, and prevent recurrence.
Examples:
Deterrent controls are designed to discourage potential attackers from attempting an incident. They increase the perceived risk or effort of an attack, making it less appealing. Deterrence is often psychological.
Examples:
Recovery controls are closely related to corrective controls but focus specifically on restoring systems and operations to normal after an incident. They ensure business continuity and data integrity.
Examples:
Compensating controls are alternative measures that provide equivalent security when the primary control cannot be implemented due to cost, technical constraints, or business reasons. They must be carefully documented and justified.
Example: If an organization cannot implement multi-factor authentication for a legacy system, it might implement strict network segmentation and enhanced logging and monitoring as compensating controls.
It is important to note that a single control can serve multiple functions. For example, a firewall is primarily preventive but also provides detection (through logs) and deterrence (by blocking known attacks). Effective security programs use a layered approach that combines controls across all functions.
A control framework is a structured set of controls, often organized by domain or objective, that provides guidance for implementing a comprehensive security program. Frameworks offer a common language, best practices, and a basis for compliance and auditing.
Annex A of ISO 27001 provides a list of 93 controls (as of the 2022 revision) organized into 4 groups: Organizational, People, Physical, and Technological. These controls are derived from ISO/IEC 27002, which provides implementation guidance. Annex A controls are mandatory for organizations seeking certification, though organizations may exclude controls that are not applicable (with justification).
Key groups:
NIST SP 800-53 is a comprehensive catalog of security and privacy controls for federal information systems and organizations. It is used extensively in US government and critical infrastructure. The latest revision (Rev. 5) contains over 1,000 controls organized into 20 families (e.g., Access Control, Audit and Accountability, Incident Response, System and Communications Protection).
Each control is described with a statement, supplemental guidance, and assessment procedures. NIST SP 800-53 is often used in conjunction with the NIST Risk Management Framework (RMF) and is highly detailed, making it suitable for organizations with mature security programs.
The Center for Internet Security (CIS) Controls (formerly the SANS Top 20) are a prioritized set of 18 actions that organizations can take to defend against the most common cyber attacks. They are designed to be actionable and implementation-focused, with three implementation groups (IG1, IG2, IG3) based on organizational maturity.
Key controls (examples):
The CIS Controls are widely adopted, especially by organizations looking for a practical, prioritized approach to improving security.
COBIT is a framework for IT governance and management, developed by ISACA. It provides 40 governance and management objectives, each with associated controls and activities. COBIT is process-oriented and focuses on aligning IT with business goals. It is often used to design and assess the overall governance of IT, including security.
COBIT's control objectives are organized into five domains: Evaluate, Direct, and Monitor (EDM); Align, Plan, and Organize (APO); Build, Acquire, and Implement (BAI); Deliver, Service, and Support (DSS); and Monitor, Evaluate, and Assess (MEA).
| Framework | Primary Use | Number of Controls | Target Audience | Key Characteristics |
|---|---|---|---|---|
| ISO 27001 Annex A | ISMS certification | 93 (2022) | Any organization seeking certification | Structured groups; aligned with ISO 27001 requirements; mandatory for certification |
| NIST SP 800-53 | Federal and critical infrastructure | Over 1,000 | US government agencies, contractors | Comprehensive; risk-based; detailed assessment procedures; privacy controls included |
| CIS Controls | Practical defense against top threats | 18 (with sub-controls) | Any organization, especially those with limited resources | Prioritized; implementation groups; actionable; community-developed |
| COBIT | IT governance and management | 40 governance/management objectives | Organizations needing IT governance alignment | Process-oriented; business-focused; integrates with other frameworks |
Selecting the right controls is a systematic process that should be grounded in risk assessment. The following steps provide a structured approach:
A key consideration in control selection is the return on investment (ROI) or cost-benefit analysis. The cost of a control should be weighed against the expected reduction in risk. This is often expressed as:
Risk reduction can be estimated using quantitative measures (e.g., reduction in ALE) or qualitative assessments. Controls that cost more than the risk reduction they provide may not be justified unless required by regulation or compliance.
Controls are not "set and forget." They must be continuously evaluated to ensure they are functioning as intended and providing the expected level of protection. Evaluation methods include:
Common metrics for evaluating controls include:
If a control is found to be ineffective, it should be refined, replaced, or supplemented with additional controls.
A large financial institution identified that phishing attacks were a significant risk, often leading to credential theft. The organization decided to implement MFA for all employee accounts. The selected control was a combination of a mobile app authenticator (TOTP) and security keys (FIDO2) for high-privilege users. The implementation included:
Outcome: MFA reduced account compromises by 90% within six months. The control was cost-effective and well-received by employees after an initial adjustment period.
Lesson: A layered approach combining administrative, technical, and physical elements can make a control robust and user-friendly.
A healthcare provider needed to maintain a legacy electronic health records (EHR) system that could not be patched or upgraded easily. The system had known vulnerabilities, but replacement was scheduled for two years later. The organization implemented compensating controls:
Outcome: The compensating controls reduced the risk to an acceptable level until the system could be replaced. No incidents occurred during the interim period.
Lesson: Compensating controls can be effective when primary controls are not feasible, but they require careful planning, documentation, and ongoing oversight.
A mid-sized manufacturing company had limited security resources and needed to improve its security posture quickly. The organization adopted the CIS Controls, starting with Implementation Group 1 (IG1) which covers basic cyber hygiene. They implemented:
Within three months, the company achieved a measurable improvement in vulnerability remediation and reduced malware infections by 70%.
Lesson: The CIS Controls provide a practical, prioritized starting point for organizations with limited resources, enabling them to focus on the most impactful actions first.
Test your understanding of the material covered in this tutorial. Answers are hidden below each question.
Apply the concepts from this tutorial through these practical exercises. Complete each exercise before reviewing the sample solution.
For each of the following controls, classify it by category (administrative, technical, physical) and function (preventive, detective, corrective, deterrent, recovery, compensating). Justify your classification.
A company is migrating its applications to the cloud (AWS). They have identified risks including misconfigured storage (data leakage), insecure APIs, and unauthorized access. Using the NIST SP 800-53 control families as a guide, identify at least five specific controls that would address these risks, and classify each by type and function.
| Risk | Control (NIST SP 800-53 family) | Category | Function |
|---|---|---|---|
| Misconfigured storage | CM-6: Configuration Settings | Technical | Preventive |
| Misconfigured storage | AU-2: Audit Events – monitor configuration changes | Technical | Detective |
| Insecure APIs | SC-8: Transmission Confidentiality and Integrity (TLS) | Technical | Preventive |
| Insecure APIs | IA-11: Re-authentication (API tokens with short lifetimes) | Technical | Preventive |
| Unauthorized access | AC-3: Access Enforcement (IAM policies) | Technical | Preventive |
| Unauthorized access | IA-2: Identification and Authentication (MFA) | Technical | Preventive |
| General security | RA-5: Vulnerability Monitoring and Scanning | Technical | Detective |
A small retail business with 50 employees wants to improve its security using the CIS Controls. They have limited budget and staff. Select the most appropriate implementation group (IG1, IG2, or IG3) and list the first six controls they should implement. For each, describe a specific implementation step.
Implementation Group: IG1 (basic cyber hygiene) is most appropriate for a small business with limited resources.
A company is considering implementing an endpoint detection and response (EDR) system. The EDR costs $50,000 per year. Without the EDR, the company expects a ransomware incident every three years with an average loss of $200,000. With the EDR, the likelihood is reduced to one incident every ten years. Calculate the annualized risk reduction and the ROI of the EDR. Should the company invest?
Without EDR: ARO = 1/3 ≈ 0.33; Annualized loss = 0.33 × $200,000 = $66,667.
With EDR: ARO = 1/10 = 0.10; Annualized loss = 0.10 × $200,000 = $20,000.
Risk reduction: $66,667 - $20,000 = $46,667 per year.
ROI: ($46,667 - $50,000) / $50,000 = -0.067, or -6.7%. The cost exceeds the reduction.
Decision: Based purely on financial ROI, the investment is not justified. However, the company may consider other factors, such as reputational damage, regulatory fines, or customer trust. If these are significant, the investment might still be worthwhile.
Develop an evaluation plan for a new SIEM system that has been implemented to detect security incidents. Include:
KPIs:
Testing:
Frequency: Monthly KPI review, quarterly comprehensive testing, annual external assessment.
Feedback: Weekly meetings with security analysts to discuss alerts, false positives, and improvement opportunities. Use a feedback form to capture specific issues.
These homework questions require deeper analysis and research. Complete them independently and review the sample answers below.
Select a real-world organization (e.g., a hospital, a bank, a university) and identify five significant cybersecurity risks it faces. For each risk, select three controls from a framework of your choice (e.g., ISO 27001 Annex A, NIST SP 800-53) that would mitigate the risk. Explain how each control addresses the risk and classify it by type and function.
Organization: Regional Hospital
Risks and Controls:
Write a 1,000-word essay comparing and contrasting the NIST SP 800-53 and ISO 27001 Annex A control frameworks. Discuss their origins, structure, target audience, and how they address different organizational needs. Provide recommendations for when each framework might be preferred, and when a hybrid approach is beneficial.
This is a sample outline; students should produce a full essay.
Introduction: Two prominent control frameworks are NIST SP 800-53 and ISO 27001 Annex A. While both aim to improve security, they differ in scope, detail, and applicability.
NIST SP 800-53: Originated in US government, comprehensive (over 1,000 controls), designed for federal systems, integrated with the Risk Management Framework. Highly detailed, with assessment procedures. Best for US federal agencies, contractors, and organizations seeking a rigorous, risk-based approach.
ISO 27001 Annex A: Part of the international standard for ISMS, 93 controls organized into 4 groups. Designed for certification, flexible, and applicable to any organization. Less prescriptive than NIST, allowing customization.
Comparison: NIST is more prescriptive and detailed; ISO is more generic and certification-focused. NIST is larger; ISO is more concise. NIST includes privacy controls; ISO's privacy aspects are addressed elsewhere (e.g., ISO 27701).
Hybrid: Many organizations use NIST for detailed control design and ISO for certification. They can be mapped to each other (e.g., NIST SP 800-53 controls can be mapped to Annex A).
Recommendations: NIST is preferred for government contracts and highly regulated environments. ISO is preferred for international businesses seeking certification. Hybrid is often the best for large enterprises.
You are the security manager for a mid-sized company that has decided to implement the CIS Controls. Develop a project plan for implementing the first six controls (IG1) over a 6-month period. Include milestones, resources needed, stakeholders, and risk mitigation for the project.
Project Plan: CIS IG1 Implementation
Goal: Implement CIS Controls 1, 2, 4, 6, 10, and 14 within 6 months.
Milestones:
Resources: Security team (1-2 people), IT support, budget for tools (e.g., asset management, MFA solution).
Stakeholders: IT, HR, executive management (for funding), end-users (for training).
Risk Mitigation: Pilot changes in test environment, communicate changes in advance, provide support for users.
For the following controls, design at least two metrics to evaluate their effectiveness:
Research and write a 750-word paper on the challenges of implementing security controls in cloud-native environments (e.g., containers, serverless, microservices). Discuss how traditional control frameworks (like NIST SP 800-53) may need to be adapted, and what new controls are needed to address cloud-specific risks (e.g., ephemeral workloads, API sprawl, misconfigurations).
Outline:
In this tutorial, we explored the essential topic of security controls and the frameworks that organize them. We learned that controls are the practical means by which organizations enforce policies and manage risks. They can be classified into three broad categories—administrative, technical, and physical—and they serve various functions: preventive, detective, corrective, deterrent, recovery, and compensating.
We examined four major control frameworks: ISO 27001 Annex A (certification-oriented), NIST SP 800-53 (comprehensive and detailed), CIS Controls (prioritized and actionable), and COBIT (governance-focused). Each framework has its strengths and is suited to different organizational contexts. Understanding these frameworks allows security professionals to select and implement controls that are appropriate for their organization's risk profile and maturity.
We discussed the process of selecting controls based on risk assessment, cost-benefit analysis, and operational feasibility. We also covered the importance of evaluating controls continuously through testing, auditing, and monitoring. Case studies illustrated how controls are applied in real-world scenarios, from implementing MFA to using compensating controls for legacy systems.
The key takeaway is that controls are not isolated measures but part of an integrated security program. A well-designed set of controls, aligned with a recognized framework, provides defense in depth, reduces risk, and demonstrates due diligence to stakeholders, regulators, and customers.
COMP400 — Computer and Network Security (Revision 3) • Unit 6.6 • © TrustOpen University