Controls and countermeasures

Control is one of the important elements of an information security program. A major part of security management is the development, implementation, testing, and monitoring of controls. The objective of implementing a control is to address risks by preventing, detecting, or correcting undesirable events. Effective control provides reasonable assurance that business objectives will be achieved.

Countermeasures

Countermeasures are a type of control that is implemented to address specific threats. The objective of general controls is to protect information assets from all kinds of threats whereas countermeasures are put in place in response to a specific threat. Countermeasures are generally expensive and need to be implemented when existing general controls cannot mitigate specific threats. Countermeasures can be either technical or non-technical. The following are some examples of countermeasures:

• Disabling certain operating system commands...