Security controls are safeguards or countermeasures to avoid, detect, counteract, or minimize security risks to people, physical property, information, computer systems, or other assets.
Security controls can be classified by several criteria. For example, according to the time that the control occurs relative to a security incident:
- Before the incident:
- Preventive controls are intended to prevent an incident from occurring (e.g. by locking out unauthorized intruders).
- During the incident:
- Detective controls are intended to identify and characterize an incident in progress (e.g. by sounding the intruder alarm and alerting the security guards or police).
- After the incident:
- Corrective controls are intended to limit the extent of any damage caused by the incident (e.g. by recovering the organization to normal working status as efficiently as possible).
Or, according to the security controls nature:
- Physical Controls:
- Camera systems, security personnel, fences, doors, locks and fire extinguishers
- Procedural Controls:
- Incident response processes, management oversight, security awareness and training
- Technical Controls:
- User authentication (login) and logical access controls, antivirus software, firewalls
- Legal and Regulatory or Compliance Controls:
- Privacy laws, policies and clauses
Systems of controls can be referred to as frameworks or standards. Frameworks can enable an organization to manage security controls across different types of assets with consistency.