Security Controls, Self-Audit, and Testing

As the digital ecosystem within enterprises proliferate, so do the cybersecurity risks and vulnerabilities. Before organizations look outside for effective governance, risk and compliance, and business continuity tools to manage this ecosystem, they also need to understand the importance for defining proper organizational security controls and self-audit requirements.

The controls and tests can form an effective first line of defense against cyberattacks as well as ensuring the robustness of the IT infrastructure. They allow users to be sensitized on the key policies, controls, and safeguard measures so that these are not considered as an overhead. As the leading and modern enterprises of tomorrow focus more on enabling an IT-enabled value chain for their customers, it’s important that they understand the nomenclature of security controls and need for pro-active security.

Security controls are technical or administrative safeguards or counter measures to avoid, counteract, or minimize loss or unavailability due to threats acting on their matching vulnerability, i.e., security risk. Controls are referenced all the time in security, however they are rarely defined. These important security controls encompass all the necessary safeguards or countermeasures to avoid or minimize security risks to an organization’s personal property, or nowadays, to address the increasing vulnerability of corporate data. It’s a new world that security controls need to apply to physical and virtual corporate property.

• Before the event, preventive controls are intended to stop an incident from occurring e.g. by locking out unauthorized intruders
• During the event, detective controls are intended to identify and characterize an incident in progress e.g. by sounding the intruder alarm and alerting the security guards or police
• After the event, corrective controls are intended to limit the extent of any damage caused by the incident e.g. by recovering the organization to normal working status as efficiently as possible.

From this an organization can derive that some controls are the actions that people take, these so-called administrative controls. Administrative controls are the process of developing and ensuring compliance with policy and procedures. They tend to be things that employees should do, or must always do, or cannot do. Another class of controls in security that are carried out or managed by computer systems are technical controls.

Phase Controls

Activity phase controls can be either technical or administrative and are classified accordingly as follows:

• Preventative controls exist to prevent the threat from coming in contact with the weakness.
• Detective controls exist to identify that the threat has landed in systems.
• Corrective controls exist to mitigate or lessen the effects of the threat being manifested.

These correspond to the life cycle phases of a security program. Firewalls are primarily preventative controls. Intrusion Prevention System (IPS) could be configured to be both preventative and detective. Intrusion Detection System IDS is purely detective. An effective reload of an operating system suspected of having malware from the gold standard is a corrective control. These are all examples of technical controls. Forensics and incident response are examples administrative or personnel corrective controls.

Compensating Controls

Compensating controls can be classified as alternate controls designed to accomplish the intent of the original controls as closely as possible, when the originally designed controls can not be used due to limitations of the particular environment. These are usually needed when activity phase controls are not available or when they fail for whatever reason. Therefore, in a world where things can always go wrong in spite of a company’s best efforts, it’s always important to have compensating controls in place to mitigate corporate risk, physical or virtual in this new age.

A simple way to evaluate the controls that are in place is to conduct a control self-assessment:

1. Identify process and objectives
2. Identify and assess risks
3. Identify and assess controls
4. Develop questionnaire
5. Collect and analyze questionnaire
6. Evaluate awareness training
7. Evaluate actions and reporting history

In the past the traditional focus was to assign duties and to supervise the staff. The policies were only rule driven. There was limited employee participation and a narrow stakeholder focus. The assessment was usually done by an internal auditor who may not understand the nuances of cyber security.

Today’s focus is more evolved. Employees are accountable and empowered. There is continuous improvement and learning curves, and a control self-assessment is viewed as a tool for finding what can be improved. There is extensive employee participation and training. The stakeholder focus is much broader and includes third parties such as vendors and other organizations that might be affected. The primary control analysts are now the staff at all levels and in all functions. Every employee is responsible for ensuring that controls are implemented. Corporate governance is recognized as a function of leadership to monitor organizational processes and to ensure that they are updated as needed. Self-auditors and organizational auditors do not ignore weaknesses just because they are outside of the current assessment.

SANS

SANS Institute is highly regarded and many organizations follow their list of 20 critical security controls.

The SANS 20 critical security controls are a prioritized, risk-based approach to cyber security. The SANS Institute List includes the following controls among many others:

1. Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors that can be used to exploit enterprise systems successfully.
2. Perform periodic red team exercises to test organizational readiness to identify and stop attacks or to respond quickly and effectively.
3. Plan clear goals of the penetration test itself with blended attacks in mind, identifying the goal machine or target asset.
4. Devise a scoring method for determining the results of red team exercises so that results can be compared over time.

Four tenets are fundamental in defining the critical controls: 1) focus on continuous monitoring to test and evaluate remediation; 2) automate processes to address security with efficiency, reliability, and scalability; 3) provide common metrics allowing all stakeholders to objectively evaluate and adjust security measures; and 4) put the organization in charge by using knowledge of actual attacks to build effective defenses.

Penetration testing is a must for all organizations who want to know their vulnerabilities in relation to cyber security and business continuity. Although the term has recently often been attached more often to cyber security, it also applies to penetration of the building and secure areas.

There are many purposes for penetration testing. Some of these are

1. identification of risks
2. to gain confidence before deploying a new process, system, or device
3. to help customers and stakeholders feel more confident in an organization
4. due diligence pertaining to security risk
5. compliance with regulatory requirements

Penetration testing can result in

1. better security
2. compliance
3. fewer Breaches
4. increased customer trust
5. identification of weaknesses that can be corrected

Security Controls, Audit and Testing Data Protection Regulations and Standards

Security controls, audit, and testing should be based on regulations and standards. The protection of data has been regulated for many years. The regulations and standards range from managing the data and preventing fraud, to information and communication technology readiness in a response.

Data Protection Act (DPA) 1998 was one of the first Acts relating to data. The DPA is an Act of Parliament of the United Kingdom of Great Brittan and Northern Ireland and defines UK law on the processing of data on identifiable living people.

In the United States Sarbanes Oxley Act of 2002 is a United States federal law that set and in some case expanded requirements for all U.S. public company boards, management, and public accounting firms, requires full disclosure and identifying IT areas that could allow fraud.

Health Insurance Portability Act 1996 lists risk requirements relating to personal information related to the healthcare industry.

Graham-Leach-Bliley Act of 1999 has some clauses that require financial institutions to ensure a minimum level of controls to protect the security of information.

Federal Information Security Act of 2002 has a list of security processes that must be followed for information systems that are used by the US federal government and contractors and suppliers to the federal government.

National Institute for Standards and Technology provides guidelines to secure information systems. NIST is an agency of the U.S. Department of Commerce.

International Standards Organization develops and publishes international standards. Some of these are ISO 31000 Risk Management, ISO 27001 Information Security Management, ISO 27031 Guidelines for Information and Communication Technology Readiness For Business Continuity and ISO 22301 Business Continuity Management Systems - Requirements.

Conclusion

Regardless of why an organization chooses to have good security controls, the results and return on investment are what count. Aside from legal issues, there is the issue of ethics. An organization owes it to their customers, employees, investors, and stakeholders to protect the organization and its assets. There are many security risks, and the attackers are learning new and better ways of attacking every day. Without good controls in place, an organization is not demonstrating proper due diligence.

Michael C. Redmond, PhD, MBCP, FBCI, CEM, PMP, MBA, ISO 27001, ISO 27035 and ISO 22301 Certified, PECB Certified Instructor, is CEO and lead consultant for Redmond Worldwide (www.redmondworldwide.com). Dr. Redmond is an international consultant, speaker, author, and trainer. She has helped organizations create great cyber incident response programs, plans, and playbooks; security information; event management programs; and compliance programs. Dr. Redmond has a “Basic Cyber Security” audio training series and workbook available at www.rwknowledge.com, worth six continuing education units.

Vibhav Agarwal is a senior manager of product marketing at MetricStream. Agarwal has more than 12 years of progressive experience in cybersecurity and business resilience product marketing, cloud-based enterprise software deployment, and vendor selection across high-tech, trading and capital markets, and Internet domains.