University of the Cumberlands Data Science and Big Data Analytics Discussion

Examine the classifications of security controls (physical, administrative, and technical) and the types of security controls (preventive, detective, and corrective). Explain how these different types of controls are used to enforce security policies within an organization. 

Explain the classifications and the type of security controls that are most challenging to implement. Include suggestions for overcoming these challenges. 

Please provide a resource in the APA style. 

Post two times for full credit. 

words:250

and also provide replies to below 2 student posts each in 150 words.

vam – What are data security controls?

Data security controls keep sensitive information safe and act as a countermeasure against unauthorized access. They enable risk management programs by counteracting, detecting, minimizing, or avoiding security risks to computer systems, data, software, and networks.

They include technical controls as well as operational, administrative, and architectural controls.

Additionally, controls can be preventative, detective, corrective, or compensatory.

Physical security controls

Physical controls describe anything tangible that’s used to prevent or detect unauthorized access to physical areas, systems, or assets. This includes things like fences, gates, guards, security badges and access cards, biometric access controls, security lighting, CCTVs, surveillance cameras, motion sensors, fire suppression, as well as environmental controls like HVAC and humidity controls.

Technical security controls

Technical security controls focus on hardware and software. They control access and use across the network. Some best practices include encryption, smartcards, network authentication, access control lists (ACLs), and file integrity auditing software.

Administrative security controls

Administrative security controls are also referred to as procedural control. The controls focus on day-to-day operations and often come from standards or regulation. Best practices include information security policies and procedures, vendor risk management programs, business continuity policies, and disaster recovery policies.

Types of Security Control

Preventative controls

Preventative controls work to prevent data loss. Controls such as two-factor authentication, least privilege necessary, identity management, and cloud access management allow organizations to protect their perimeter by understanding who accessed data and how they used it.

Detective controls

Detective controls focus on identifying weaknesses. Controls such as internal audit, continuous monitoring, and computer usage logs enable organizations to review locations where information could be changed or deleted. Often, they provide evidence of a data loss or potential data loss, rather than protecting against it.

Corrective controls

Corrective controls mitigate damage once a risk exists. They focus on fixing the problem if detective controls indicate that an issue has occurred. Some examples of corrective controls include documenting policies and procedures, enforcement of policies and procedures, and creating a disaster recovery and business continuity program.

A security policy is a management control, but its security requirements are implemented by people (operational controls) and systems (technical controls). Think of phishing attacks. An organization may have an acceptable use policy that specifies the conduct of users, including not visiting malicious websites. Security controls to help thwart phishing, besides the management control of the acceptable use policy itself, include operational controls, such as training users not to fall for phishing scams, and technical controls that monitor emails and web site usage for signs of phishing activity.

A common problem with security controls is that they often make systems less convenient or more difficult to use.  When usability is an issue, many users will attempt to circumvent security controls; for example, if passwords must be long and complex, users may write them down.  Balancing security, functionality, and usability is often a challenge.  The goal should be to strike a proper balance: provide a reasonably secure solution while offering the functionality and usability that users require.

krish – Security controls are countermeasures  or safeguards that are done in order detect, avoid, minimize or counteract security threats. The purpose of security controls is to reduce threats. Admistrative controls, physical controls and technical controls are the types of security controls. Physical controls are used in describing anything that is tangible and it is used in detecting and preventing unauthorized access to the system (Dennis, 2005). This may include things like gates, fences, security badges, guards, CCTVs, and biometric access.

Administrative controls are guidelines, policies, or procedures that define business practices according to the objectives of the organization.  Administrative control can also apply to physical access facilities, internet usage, data classification, separation of duties and auditing.  Technical controls are also referred to us as local controls. Examples of technical controls are firewalls, authentication, antiviruses, software, and intrusion protection systems. The types of security controls are detective, corrective and preventive. Preventive controls are designed in a way in order to avoid or prevent the like hood of a threat. Examples of preventive control include standards, processes, firewalls, and procedures. Detective controls are used in detecting a threat when it is in the process of occurring (John, 2009). They will offer help during investigation after the occurrence of the threat Examples of detective controls are network intrusion detectors, log monitoring and the antiviruses.

Corrective controls are used in mitigating a threat once it has occurred and it will help an organization in recovering to its normal operations (Micki, 2006). Therefore, the most challenging security control during implementation is the administrative control.  It is challenges since the system can be hacked leading to unauthorized access of information. An organization can also hire employees who are ignorant about security policies hence leading to malicious attack. External breaches are another challenge that is caused by poorly equipped security team. Both the insider and external threats can be mitigated by providing information security awareness.