Classifying Security Controls

A natural history museum protects the specimens in its storage rooms and its collection catalog, a staff database recording each specimen's storage location, donor, and insurance value. The catalog server stands in a rack in one corner of the specimen storage room, so that room holds both. The museum's control inventory, below, lists eight security controls. This lesson classifies each one by the principle it protects, by its type, and by its function.

Every security control addresses at least one of the three principles below. Each names something that could go wrong with the catalog. A person with no account could read its records. An edit could make a record false. Or the catalog could go offline while staff need it.

Without encryption, anyone who obtained a backup file could read every record in it, so the encryption guards confidentiality, even though the word backup suggests availability. The nightly backups are about availability: they bring the catalog back after an outage. The change history serves integrity, because a false record can be traced to whoever saved it. And the quarterly review keeps catalog access with authorized people, which is confidentiality again.

The other four controls protect the catalog too. A person in the storage room after hours could unplug the server, so the motion sensor counts under availability. The storage room opens onto the loading dock, so a server carried off would pass the dock camera, and a stolen server is both a data theft and an outage. A lost key lets its finder reach the server and take it, a threat to confidentiality and availability both, and re-keying answers both. The volunteer rule keeps catalog printouts, and the donor names on them, in the building.

The type of a control depends on what the control is. The motion sensor, the camera, and the re-keyed lock are objects in the building. The encryption, the backups, and the change history run in the catalog's servers and software. The volunteer rule and the quarterly review are procedures that people carry out.

The quarterly review concerns catalog accounts, so it looks technical. But it's a procedure: each quarter a staff member compares the account list with the current staff and volunteers.

The function of a control is its role with respect to an attack. A control can stand in the way of an attack, identify one while it happens, or repair what has gone wrong.

The encryption and the volunteer rule are preventative. Each closes a way in before an attack: a readable backup, an item off site.

The motion sensor, the camera, and the change history are detective. None of them stops anyone. They report a person in the room after hours, record who passes the dock, and record each edit as it's saved. The quarterly review is detective too: it finds accounts that should already have been closed, such as those of volunteers who have left.

The nightly backups and the re-keying are corrective. The backups restore the catalog to an operational state. Re-keying looks preventative, since a lock is preventative. But it answers a problem that has already happened: a lost key that opens the storage room. It makes the lost key useless, so it's corrective.

Type and function are separate classifications. The camera and the change history share a function and differ in type.