Information Security Control Design and Selection

Control is one of the most important elements of an information security program. A major part of security management is the development, implementation, testing, and monitoring of controls. The objective of implementing a control is to address risks by preventing, detecting, or correcting them. An effective control provides reasonable assurance that the business objectives are achieved.

Figure 6.1: Information security control design and selection

Countermeasures

Countermeasures are a type of control implemented to address specific threats. They can be either technical or non-technical. While the objective of general controls is to protect information assets from all threats, countermeasures are put in place in response to specific threats. Countermeasures are generally expensive and are implemented only when existing general controls cannot mitigate specific threats. The following are some common examples...