- Welcome to lesson one,
Compare and Contrast Various Types of Security Controls.
In our first lesson, 1.1 Control Objectives,
we are gonna focus 100% on controls.
Why?
Because as a cybersecurity practitioner,
you're gonna be all about controls.
You are gonna be implementing controls,
and managing controls, and monitoring controls.
You'll be selecting controls.
You will be advising others on controls,
and you'll be educating on controls.
So it's really important
that you have a good grounded foundation
in understanding how we use controls,
why we use controls,
what do we expect of our controls,
as well as different control categories and classifications.
So let's get started.
Before we start talking about controls though,
I just wanna go through a couple of terms
some cyber basic terms that we're gonna use
all the way through this course,
just to make sure that we're defining them
in the same way, you and I.
So starting with the first one, vulnerability.
A vulnerability is a weakness.
Now, it could be a weakness in a person,
in an infrastructure, in building,
in software, in hardware, in a device,
but very simply, it just refers to a weakness.
A threat is a potential danger,
something that wants to harm us.
Now, threats can be adversarial and non-adversarial.
Adversarial means that we have an adversary
who's targeting that threat.
Non adversarial means it's not really targeted at us.
For example, a flood or a power outage
or some type of weather event.
Still a danger, but not adversarial.
Third is a threat actor.
A threat actor is an adversary,
an adversary meaning an opponent that has malicious intent.
And lastly, is an exploit.
An exploit is when that threat actor
successfully takes advantage of the vulnerability
or of that weakness.
So the threat actor says,
"Okay, I know that weakness is there."
I'm gonna take advantage of that weakness
over that vulnerability,
and that becomes our exploit.
So, vulnerability, threat, threat actor, and exploit,
terms we're gonna use all through this course.
So let's start talking about controls.
We're gonna define controls as tactics,
mechanisms, or strategies
that proactively minimize risk
in one or more of the following ways.
Now, before I share those ways with you,
let's just dissect this sentence a little bit.
Proactively means we're doing it ahead of time,
minimize means we're gonna diminish,
and risk just refers to a level of uncertainty.
So our controls or tactics, mechanisms, or strategies
that, ahead of time, bring down the level of uncertainty
in one or more of the following ways.
It will either reduce or eliminate a vulnerability,
reduce or eliminate the likelihood
that a threat actor will be able
to exploit the vulnerability
or reduce or eliminate the impact of an exploit.
Now, a control can do one of these,
two of these, or all three,
but it has to do at least one to be considered a control.
Now, you may have heard the term countermeasure
because very often it's used interchangeably with control,
but it doesn't mean the same thing.
Countermeasures are controls that are implemented
to address a specific threat.
So where our controls were fairly broad based
and they were proactive,
countermeasures are generally reactive
and they may be more effective for that specific threat,
but they're less broadly efficient.
So let me give you an example of a countermeasure.
Perhaps in your threat intelligence,
you learn that a particular IP address
is distributing malicious software or malware.
So you block that.
You set up a firewall rule
to block access to that IP address.
That would be a countermeasure specific for that threat,
very efficient for that threat,
but doesn't really have a broad application.
And we wanna know that our controls work
and they do what we expect them to do.
And we summarize that as thinking about the fact
that our controls should be trustworthy.
So when we're evaluating a control,
there's a couple things we wanna look at.
First is functionality
and functionality is what a control does.
And second is effectiveness.
Effectiveness is how well a control works.
Now, effectiveness reflects the control's consistent,
complete, reliable, and timely operation.
So when we are assessing our controls,
we're looking at both the functionality
and the effectiveness.
And the process of assessing those controls
is referred to as assurance.
Assurance is a measure of confidence
that the intended security controls
are effective in their application.
A control objective is a statement
of desired result or purpose to be achieved
by implementing either a single control
or more likely a set of controls.
And so a control objective is,
what am I trying to achieve
or what am I trying to accomplish?
Let me give you an example.
I might have a control objective that says,
"I wanna protect my hosts or my endpoints
from malware infiltration."
How am I gonna do that?
Well, you and I know we're not gonna do it
with just one control.
And so maybe there's a whole series of controls.
They may be related or unrelated,
antivirus software, a host firewall,
restricted email attachments, URL filtering, sandboxing.
All of those are individual, discreet controls
that we use to achieve our control objective,
in this case, to protect hosts from malware infiltration.
And we really wanna make sure
that we have security control diversity,
that we're not depending upon just one control
or just the same type of control over and over again.
So defense-in-depth,
also known as layered security or layered controls,
is the design and implementation
of multiple overlapping layers of diverse control.
So if one control fails,
hopefully, the next control is successful.
Now, control should not be subject to a cascade effect
and should always, always maintain their independence.
What do we mean by a cascade effect?
Well, think about a bunch of dominoes all set up in a row.
And if you tip one over, boom, boom, boom, boom, boom, boom
all the dominoes fall over.
That would be a cascade effect.
We wanna make sure that that doesn't happen,
and that our controls remain independent of each other,
and that we wanna have different types of controls,
referred to as a diversity of controls,
and we wanna use more than one vendor.
So we wanna have diversity of controls
and diversity of vendors.
Now we use security control baselines
to express the minimum standards for a given environment.
Now, you can develop your own security control baselines
or you do what most of us actually do,
is go out and research the security control baselines
that are already available to us
because there is so much work
that's already been done in this area,
and we're gonna talk about some of those in just a sec,
but let's talk a little bit more about what a baseline does.
Again, the baseline expresses minimum standards
for a given environment.
But when you adopt a baseline,
they should always serve as a starting point
and you need to make sure
that they are strategically aligned
with the needs of the organization,
which is something you're gonna hear me say a ton of times.
We never want to adopt a control baseline,
or a policy, or a new tool just 'cause,
"Ooh, that sounds cool and interesting."
Uh-uh never.
We always wanna make sure that whatever action we're taking,
it is always in support of the organization
and it strategically aligns
with the needs and the strategy of the organization.
And control baseline should also be
proportionate to the criticality
and the sensitivity classifications
of the asset being protected.
And we refer to that as the principle of proportionality.
There's some excellent control guidance out there.
NIST is the National Institute of Standards and Technology.
It's a US government agency,
and they have just a compendium of information and documents
and standards available to you for free.
You can freely download and adopt them.
NIST has the NIST Special Publication 800 -53.
Current revision is revision five,
which is security and privacy controls
for information systems and organizations.
And then NIST has three frameworks that I just love.
They're really fantastic.
They have the CSF
that's known as the cybersecurity framework,
the privacy framework,
and the risk management framework
from which you can take your controls
and control objectives.
Now, what's really interesting about NIST is,
even though it's a US government agency,
when they do these publications
and they design these control sets and these frameworks,
they're really doing it with a bigger audience in mind.
Matter of fact, when they developed
the NIST Cybersecurity Framework,
the agency actually invited in representatives
of industry, and academia, and the nonprofit sector
to really help and have input into developing the framework.
And because they recognize
that they could easily be used worldwide,
the NIST Cybersecurity framework
has been translated into multiple languages.
If you're not familiar with
the NIST special publications or the frameworks,
please absolutely take time to go out
and really learn about them.
You will not be tested specifically on them for the exam,
but they're an incredible resource
for your day-to-day cybersecurity practice.
Now, another really good set of controls guidance
is published by the ISO.
The ISO is the
International Organization for Standardization,
and you can learn more about them at iso.org.
Now, they are globally recognized
and their standards are adopted
by a lot of multinational companies,
and they have the ISO 27014:2020,
which is the Information Security Cybersecurity
and Privacy Protection Standard.
Now, the caveat with the ISO is that it is proprietary.
And to have access to the ISO materials, you do need to pay.
So once you've made a decision about your controls baseline
the next step is saying,
how do I make these just really applicable,
really perfect for my organization?
So we go through the process of fine tuning the controls,
and it's a four-step process,
scoping, tailoring, compensating, and supplementing.
Scoping is eliminating
any unnecessary baseline recommendations
that are not applicable to your organization.
So it's like, "Oh, I don't need that.
That doesn't make sense for my organization.
Scratch it, Get rid of it."
Tailoring is customizing those baseline recommendations
to align with organizational requirements.
It's like going to the store, you buy a suit off the rack.
Looks okay, but you wanted to look great, really fit well.
So you go to the tailor, and the tailor takes it in,
lets it out, whatever it needs to be done
just to make it perfect.
So it's customizing the baseline recommendations
to align with organizational requirements.
Now, third is compensating.
Compensating is substituting a recommended baseline control
with a similar control.
Maybe there's a recommended control,
but for whatever reason, you can't implement that control.
So we put in a similar one
that would be referred to compensating.
And lastly, supplementing is when we augment
or add to the baseline recommendations.
Maybe there's something specific in your environment
that needs additional controls.
You wanna add to that baseline.
So scoping, tailoring, compensating, and supplementing.
So what is the baseline modification process look like?
Well, we start with identifying our control baselines.
They could be ones that we've written,
but more likely we're gonna look at NIST,
we're gonna look at ISO,
or we'll look at other industry baselines.
We'll apply the scoping considerations,
meaning that we will say which ones
are not applicable to my organization, and get rid of them.
We'll tailor or fine tune those controls.
We will select compensating controls if needed.
They may not be necessary at all.
And we'll supplement the baseline, again, if needed.
A baseline might be comprehensive
and you don't need to add anything,
or you might need to.
Then we're gonna publish 'em.
So everyone in our organization knows what we're using.
We will implement them.
We will assess to make sure
that they are working in the ways
that we expect them to work, that they're trustworthy.
And we will continue to monitor the control baseline
and all the individual controls.
Why, because things change over time,
and we wanna make sure that they're continuing to operate
and function in the way we expect them to.
We also want to make sure that our
controls are subject to a cost benefit analysis.
A cost benefit analysis is really looking
at the financial implications of a control.
So the cost benefit analysis,
being the process of comparing
the estimated costs and benefits
to determine whether it makes sense
to proceed from a business perspective.
Now, if the cost of a control is significantly lower
than the losses without the control,
well, that's easy, right?
The cost of the control is generally justified.
Conversely, if the cost of control is significantly higher
than the loss without the control,
well, the cost probably isn't justified.
It doesn't make any sense.
And when they're about the same,
you're going to do a return on investment, an ROI,
to determine whether the cost is justified.
The cost certainly is never the only determinant.
We are also looking at reputation,
and regulatory requirements,
and our strategy inside our organization.
But because we have to pay for many of our controls,
we always wanna make sure
that we're looking at the financial benefit as well.
And that, my friends, brings us to
our first three-second challenge.
We're going to have a three-second challenge
in every sub lesson.
And for each three second challenge,
what I'm gonna do is I'm gonna give you
a statement or a term,
and I want you to shout out
and I mean that, sitting at your computer,
shout out what you think the correct answer or response is.
I'm gonna give you three seconds for each of these.
So let's go ahead and do our first set, ready?
Let's go.
Statement of desired result to be achieved
by implementing a control.
I want you to tell me what that is,
and I want you to shout it out at your computer.
I'm gonna give you three seconds.
One, two, three.
Well, hopefully you said a control objective.
All right, number two.
The term used to describe multiple layers
of diverse controls.
One, two, three.
Shout it out.
Defense-in-depth or layered security or layered controls,
all of those would work.
Number three,
set of minimum controls for a given environment.
One, two, three.
That's our control baseline.
You getting the hang of it, I bet.
Number four, the process of eliminating
unnecessary baseline recommendations.
Remember this is part of that four-step process.
One, two, three.
That's gonna be scoping.
And lastly, number five,
a control implemented to address a specific threat.
One, two, three.
We talked about this way at the beginning.
That's gonna be a countermeasure.
Also, in every sub lesson,
we're gonna be doing a security-in-action case study.
Now, the objective of the security-in-action case study
is for you to be able to apply your knowledge,
what we just learned and talked about in a practical manner.
So in our first security-in-action case study,
we're gonna be talking about adopting a control baseline.
And what I want you to do is I want you to
get ready to put me on pause.
We're gonna read through the case study,
and then there's gonna be a question
or two that you need to answer.
So at that point, you'll put me on pause
you'll think about what your answer is.
If you want, write it down.
And then when you're ready, take me off pause,
come back, and we'll go through the answer together.
So in our first security-in-action case study,
adopting a control baseline,
external auditors have recommended
that your organization adopt the ISO 27014
as a control baseline.
And you concur with the recommendation
and the management's response is that they worry about
the applicability and the cost of implementing
such a broad set of controls.
So my question to you is,
what would you say to them to alleviate their concerns?
Go ahead if you want to put me on pause,
think about it, jot down your answer,
come on back when you're ready.
Well, here might be your response.
Begin the conversation by explaining
that control baselines are a starting point,
and the goal is going to be
to strategically align the controls
with the needs of the organization.
So you won't be implementing anything you don't need.
The adoption process includes scoping,
remember that's eliminating unnecessary controls,
tailoring, that was customizing and fine tuning,
compensating, substituting controls if necessary,
and supplementing, adding controls as warranted,
till you get that really perfect set of controls.
And you wanna assure them
that a baseline can be phased in over time.
It's really not unusual to phase in a baseline
over six months, or 12 months, or 18 months,
or even up to 36 months,
and certainly can be in concert
with your budget allocations.
And being able to have this conversation,
that, my friends, is security-in-action.
Now, we're gonna be ending every sublesson
with a word cloud.
I want you to stare at this word cloud.
Put me on pause when we're done,
and really, really look at this word cloud.
And what I want you to do is go through
each one of these terms
and make sure that you know what it is,
that you can speak to it, that you can explain it.
These are all terms that we will have covered in the lesson.
And if you can't,
then go back through the lesson till you can.
And then when you're ready,
come on and join me in the next lesson.
I'll be waiting for you right there.