2.3Types of Controls and the Security Organization

Controls are what actually respond to the risks identified and evaluated through risk assessment. Controls become truly effective only when measures of different natures--technical, physical, human, and organizational--are combined. And no matter how excellent the controls prepared, they will not function if the structure and locus of responsibility for operating them are ambiguous. This section covers the categories of controls and the organizational structure that supports them (separation of duties, least privilege, CISO).

2.3.1The four categories of controls

• Technical controls are measures realized through systems and equipment (for example, firewalls, access control, encryption, antivirus software). Physical controls are measures realized through physical space and facilities (for example, entry/exit management, locks, surveillance cameras, fireproof safes).
• Human (personnel) controls are measures that work on people's behavior and awareness (for example, signing confidentiality agreements, security education and training, disseminating rules). Organizational controls are measures realized through organizational structure and rules (for example, establishing a security committee, clarifying separation of duties, building an incident response structure). Combining controls from multiple categories for a single risk (defense in depth) increases effectiveness.

2.3.2Separation of duties and the principle of least privilege

• Separation of duties is an organizational control that splits roles among multiple people so that authority or process steps do not concentrate in one person (for example, having a different person submit a request than the one who approves it, or separating the developer from the person who deploys to production). The purpose is to prevent a situation where one person could both commit and conceal fraud single-handedly because they control the entire process.
• The principle of least privilege is the idea of granting users only the minimum privileges necessary for their job. Granting excessive privileges widens the scope of damage if that user's account is compromised and also increases the opportunity for internal fraud, so keeping privileges to the necessary minimum curbs risk. It becomes truly effective only when paired with operations that promptly review (remove or change) privileges upon transfer or resignation.

2.3.3The CISO and the security organization

• The CISO (Chief Information Security Officer) is a role that, as a member of management, bears decision-making authority and responsibility for information security company-wide. Rather than leaving it to the field, deciding risk acceptance criteria and investment at the management level enables security measures that align with business strategy.
• A security committee is an organizational body, under the CISO, in which representatives from each department participate to deliberate on company-wide policy and coordinate cross-departmental issues (for example, an information security committee). Judgments made by a single department alone lose company-wide consistency, so establishing a venue for cross-departmental coordination matters.
• Education and training are the core of human/personnel controls. Even with rules in place, they will not function unless employees understand the content and reflect it in their behavior, so ongoing efforts to raise security awareness--regular training, targeted-attack-email drills, and the like--are essential.

Consider an example where an internal audit flagged a problem in a company's information systems department: a developer could directly access the production database and change arbitrary data. Left as-is, this state means a single developer could, on their own judgment, both commit unauthorized data tampering and conceal the traces of it--a textbook case of separation of duties failing to function. As an improvement, first, as an organizational control, a separation-of-duties rule is established: "changes to production are carried out by a release owner, separate from the developer, only after reviewing the requested change." Next, as a technical control, the developer's account is changed so it is not granted direct access to the production database, with only the release owner's account able to access it. This is a direct application of the principle of least privilege--the judgment being that a developer needs only the access necessary for the development environment, and production access is unnecessary. In addition, in case the release owner's account is misused, a physical control restricts the terminal used to operate on production to a dedicated work room with entry/exit management, and a human/personnel control provides the staff involved with a re-confirmation of confidentiality agreements and training on handling operation logs. Combining all four categories--technical, physical, human, and organizational--for a single deficiency in this way establishes defense in depth, where other measures compensate even if any one measure is defeated. And rather than leaving the necessity or investment priority of such improvements solely to the judgment of the field, reporting them to a security committee chaired by the CISO, for formal approval against company-wide risk acceptance criteria, establishes a structure that enables consistent, cross-departmental decision-making.

2.3.4Section summary

• Controls fall into four categories--technical (systems/equipment), physical (space/facilities), human (behavior/awareness), organizational (structure/rules)--and combining them for defense in depth raises effectiveness
• Separation of duties splits roles among multiple people to prevent concentration; the principle of least privilege grants only the minimum privileges necessary
• The CISO bears company-wide information security responsibility as a member of management; a security committee deliberates and coordinates across departments; education/training are the core of human controls