Control Design and Implementation

As we learned earlier in this book, risk mitigation is one of the most common responses in risk management. A risk manager needs to be aware of adequate risk mitigation techniques to reduce the risk to an acceptable level. Control design and implementation is one of the most important steps in risk mitigation. With the ever-changing threat landscape, the controls that are implemented today may become irrelevant tomorrow, and therefore, controls should be reviewed periodically to determine and continue their effectiveness.

This chapter aims to help you learn about the different types of controls, standards, frameworks, and methodologies for control design and selection, as well as how to implement them effectively. We will also learn about several control techniques and methods to evaluate them effectively.

In this chapter, we will cover the following topics:

• Control categories
• Control design and selection
• Control implementation...

Control categories

Before we jump right into the control types, I think it is important to learn a bit about what constitutes a control. A control is a measure that helps reduce risk and improve the security posture of the organization. This control can be technical, such as antivirus software, something physical, such as a turnstile, or a policy document that dictates the ideal course in business operations.

These controls can be categorized as follows:

• Preventive (also known as preventative): These controls prevent any security violations and practices. Installing antivirus software to prevent malicious software or a firewall from blocking unknown traffic is an example of preventive control.
• Detective: These controls detect violations of security policies and practices. Intrusion detection systems (IDSs) or audit logs are examples of detective control.
• Corrective: These controls correct a certain issue that has not been prevented or detected and led to an undesired...

Control design and selection

If someone asks you in a rapid-fire round what level of control a risk practitioner should implement, the correct answer is always optimal. We have touched on this a few times in previous chapters, stating that a control should always be implemented per the risk posed by the threat and evaluated for effectiveness, efficiency, and cost before it’s implemented. There is no reason to implement a control that exceeds the cost of assets.

As we discussed earlier, these controls can be either proactive (also known as safeguards), in that they will try to prevent the incident from occurring in the first place, or they can be reactive, in that once the incident has happened, these controls will assist in detection and correction. In some cases, the risk practitioner will have the option to choose the type of control to be implemented as per the business requirements; however, regardless of the selected control, the main purpose of implementing control...

Control implementation

In the previous chapter, we learned about configuration management, which refers to setting initial baselines for systems and tools so that it becomes easier for the relevant teams to install and manage that software. In this context, configuration management is a preventative control that ensures that no unapproved software and services are installed on the user’s laptop. The same goes for change management as well, where changes have been made to production system code that need to be tested in a test environment before being rolled out to all the users.

On a related note, it is important to ensure that once these changes have been set, the control is also tested in a non-production environment so that any errors from the test environment do not carry over to the production environment and affect a large set of systems or users in terms of unapproved changes. The ideal way to set up this test environment is to have it reflect the production environment...

Control testing and evaluation

Testing the effectiveness and efficacy of a control is as important as implementing them. A risk practitioner should ensure that implemented controls are tested and evaluated periodically to ensure that they are still relevant and advise the risk owner in case of any gaps that have occurred since the initial implementation. The responsibility to determine the efficacy of controls periodically relies on the control owner. Control testing can be either progressive or regressive. Progressive testing begins with the requirements and looks for flaws, whereas regressive testing works backward from the expectations of the results and known issues to identify causes.

The following are some of the best practices for effectively evaluating controls:

• Never use production data for testing purposes and always produce synthetic data that’s as similar to the production data as possible for testing. If there is an absolute need to use the production...

Summary

At the beginning of this chapter, we learned about the five control categories (preventative, detective, corrective, deterrent, and compensating) and their relationship with incidents. We then learned about how a risk manager should design and select the controls as per the requirements of the business. Next, we learned about the different methods of control implementation (parallel, phased, and abrupt) and the importance of post-implementation review. Finally, we reviewed the best practices for control testing and evaluation.

In the next chapter, we will learn about log aggregation, risk and control monitoring, and reporting.

Review questions

1. Which of the following is not a control category?
   1. Additive
   2. Preventative
   3. Deterrent
   4. Detective
2. Implementing controls proactively based on a previous root cause analysis is an example of which control category?
   1. Preventive
   2. Detective
   3. Corrective
   4. Compensating
3. Reviewing audit logs in a SIEM tool is an example of __.
   1. Corrective control
   2. Detective control
   3. Compensating control
   4. Deterrent control
4. Installing security cameras to secure a data center location is an example of __.
   1. Corrective control
   2. Detective control
   3. Compensating control
   4. Deterrent control
5. A risk manager introduced additional oversight of an accounting system where logical controls are not yet implemented. This is an example of ___.
   1. Corrective control
   2. Detective control
   3. Compensating control
   4. Deterrent control
6. An IT system failed while new changes were being pushed to it from the production team and lost some data. The risk manager has advised the IT team to restore the data from previous backups. This is an example...

Answers

1. A. Additive is not a control category; all the other options are valid control categories.
2. A. Implementing controls proactively is an example of preventive control.
3. B. Reviewing audit logs is an example of detective control as the incident has already happened and the goal is to find what caused the incident.
4. D. Installing security cameras is an example of deterrent control.
5. C. Implementing additional controls instead of the primary control is an example of compensating control.
6. A. Performing a restore exercise is an example of corrective control.
7. C. Detective and corrective controls are used after the incident has happened.
8. A. Since the system is business-critical and should not have any downtime, the risk manager should recommend parallel changeover, where both the old and new systems will run in parallel.
9. B. Performing a phased changeover would be the most efficient as no two modules are dependent on each other and the update is modular...