Security controls are parameters implemented to protect various forms of data and infrastructure important to an organization. Any type of safeguard or countermeasure used to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets is considered a security control.
Given the growing rate of cyberattacks, data security controls are more important today than ever. According to a Clark School study at the University of Maryland, cybersecurity attacks in the U.S. now occur every 39 seconds on average, affecting one in three Americans each year; 43% of these attacks target small businesses. Between July 2018 and April 2019, the average cost of a data breach in the United States was USD 8.2 million.
At the same time, data privacy regulations are growing, making it critical for businesses to shore up their data protection policies or face potential fines. The European Union implemented its strict General Data Protection Regulation (GDPR) rules last year. In the U.S., California’s Consumer Privacy Act is set to take effect January 1, 2020, with several other states currently considering similar measures.These regulations typically include stiff penalties for companies that do not meet requirements. For example, Facebook recently reported it anticipates a fine of more than USD 3 billion from the U.S. Federal Trade Commission for shortcomings around data protection policies that led to several data breaches.There are several types of security controls that can be implemented to protect hardware, software, networks, and data from actions and events that could cause loss or damage. Physical security controls include such things as data center perimeter fencing, locks, guards, access control cards, biometric access control systems, surveillance cameras, and intrusion detection sensors.
Digital security controls include such things as usernames and passwords, two-factor authentication, antivirus software, and firewalls.
Cybersecurity controls include anything specifically designed to prevent attacks on data, including DDoS mitigation, and intrusion prevention systems.
Cloud security controls include measures you take in cooperation with a cloud services provider to ensure the necessary protection for data and workloads. If your organization runs workloads on the cloud, you must meet their corporate or business policy security requirements and industry regulations. Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls.
Systems of security controls, including the processes and documentation defining implementation and ongoing management of these controls, are referred to as frameworks or standards.
Frameworks enable an organization to consistently manage security controls across different types of assets according to a generally accepted and tested methodology. Some of the best-known frameworks and standards include the following The National Institute of Standards and Technology (NIST) created a voluntary framework in 2014 to provide organizations with guidance on how to prevent, detect, and respond to cyberattacks. The assessment methods and procedures are used to determine if an organization’s security controls are implemented correctly, operate as intended, and produce the desired outcome (meeting the security requirements of the organization). The NIST framework is consistently updated to keep pace with cybersecurity advances.Enforces IT security policies through security controls
Educates employees and users about security guidelines
Meets industry and compliance regulations
Achieves operational efficiency across security controls
Continually assesses risks and addresses them through security controls
A security solution is only as strong as its weakest link. You should, therefore, consider multiple layers of security controls (which is also known as a defense-in-depth strategy) to implement security controls across identity and access management, data, applications, network or server infrastructure, physical security, and security intelligence.
