Implementing policies to mitigating security risk in organizations

Security controls play a fundamental role in improving and shaping the actions security professionals take to protect an organization. In this article, I will be discussing three main types of security controls that should be implemented at the cause of drafting organization’s security policy.

“According to the IDC survey, 72 percent of organizations in Nigeria have increased security budgets by 10 percent or more over the last few years. This is not only the result of accelerated cloud adoption levels, but also increased awareness of security in senior management and rising new threats.”

They are three prime factors constituting implementing a security policy; technical, administrative, and physical. The primary goal for implementing a security control can be preventative, detective, corrective, compensatory, or act as a deterrent. Controls are also used to defend people as is the case security awareness training or policies.

The lack of security controls places the confidentiality, integrity, and availability of information of every organization at risk. These risks extend to the safety of people and assets within organizations. Security control is the different ways in which we can integrate it in our security policy.

Security controls are countermeasures used to reduce the chances that a threat will exploit a vulnerability. For instance, implementing company-wide security awareness training to minimize the risk of a social engineering attack on your network, people, and information systems.

While it’s next to impossible to prevent all threats, mitigation seeks to decrease the risk by reducing the chances that a threat will exploit a vulnerability. Risk mitigation is achieved by implementing different types of security controls depending on the goal of the countermeasure, the level to which the risk needs to be minimized, the severity of damage the threat can execute.

The overall aims of implementing security controls is to help reduce risks in an organization. The effective implementation of a security control is based on its classification in relation to the security incident.

The common classifications are; preventive controls attempt to prevent an incident from occurring, detective controls attempt to detect incidents after they have occurred, corrective controls attempt to reverse the impact of an incident, deterrent controls attempt to discourage individuals from causing an incident, compensating controls are alternative controls used when a primary control is not feasible.

For instance, an organization that places a high priority on reducing risk usually has a risk profile, which demonstrates the potential cost of a negatively impacting risk and the human resources required to implement the control(s).

Further on, we look at layering approach which combines multiple security controls to develop what’s called a defence-in-depth strategy. Defence-in-depth is a common security strategy used whereby multiple layers of controls are implemented. By combining controls into multiple layers of security you ensure that if one layer fails to offset a threat that other layers will help to prevent a breach in the system. Each layer of security works to counteract specific threats, which requires a security program to invest in multiple technologies and processes to prevent systems or people from being compromised.

Endpoint detection and response solutions are great at preventing viruses and malware from infecting computers and servers. However, endpoint detection is not equipped to log and monitor traffic on a network, or detect and prevent an attack in real-time like an Intrusion Prevention System (IPS).

Before going into control types, it’s important to first understand the cyber risks and threats they help to mitigate. Risks in cyber security are the likelihood that a threat will exploit a vulnerability resulting in a loss. Losses could be information, financial, damage to reputation, and even harm customer trust. Threats on the other hand are any event with the potential to compromise the confidentiality, integrity, and availability (CIA) of information.

Threats may also take the form of a natural disaster or be a synthetic risk such as a new malware variant. Secondly, we look at vulnerabilities which are weaknesses or flaw in the software, hardware, or organizational processes, which when compromised by a threat, can result in a security incident. such occurrence can potentially jeopardize the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits.

Having understood the basic risk concepts let’s explore how security controls will be implemented. At the most basic level, technical controls, also known as logic controls, use technology to reduce vulnerabilities in hardware and software. Automated software tools are installed and configured to protect these assets such as encryption, antivirus and anti-malware software, firewalls, Security Information and Event Management (SIEM), Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS).

Many organizations today implement some type of onboarding process to introduce you to the company and provide you with a history of the organization. During the onboarding process, you may be instructed to review and acknowledge the security policy of the organization. By acknowledging that you have read the policies of the organization as a new hire, you are then accountable to adhere to the corporate policy of the organization.

In order to implement the administrative controls, additional security controls are necessary for continuous monitoring and enforcement. The processes that monitor and enforce the administrative controls will be Management controls: The security controls that focus on the management of risk and the management of information system security and operational controls.