Security controls
From Wikipedia, the free encyclopedia
[edit] IA Controls
Here's some more information on IA controls AKA security controls:
From DoDI 8500.2 there are 8 in the following two letter acronyms (TLA).
- DC Security Design & Configuration
- IA Identification and Authentication
- EC Enclave and Computing Environment
- EB Enclave Boundary Defense
- PE Physical and Environmental
- PR Personnel
- CO Continuity
- VI Vulnerability and Incident Management
DoD breaks the down per CIA Triad (leg) or IA service.
From NIST Special Pub - SP 800-53 rev 1
- AC Access Control
- AT Awareness and Training
- AU Audit and Accountability
- CA Certification, Accreditation, and Security Assessments
- CM Configuration Management
- CP Contingency Planning
- IA Identification and Authentication
- IR Incident Response
- MA Maintenance
- MP Media Protection
- PE Physical and Environmental Protection
- PL Planning
- PS Personnel Security
- RA Risk Assessment
- SA System and Services Acquisition
- SC System and Communications Protection
- SI System and Information Integrity
NIST uses DoD methology by breaking down the control into TLAs and into Defense in Depth (computing) category (People - Techonology - Operations/Process).
From ISO 17799
Risk assessment and treatment - analysis of the organization's information security risks
- Security policy - management direction
- Organization of information security - governance of information security
- Asset management - inventory and classification of information assets
- Human resources security - security aspects for employees joining, moving and leaving an organization
- Physical and environmental security - protection of the computer facilities
- Communications and operations management - management of technical security controls in systems and networks
- Access control - restriction of access rights to networks, systems, applications, functions and data
- Information systems acquisition, development and maintenance - building security into applications
- Information security incident management - anticipating and responding appropriately to information security breaches
- Business continuity management - protecting, maintaining and recovering business-critical processes and systems
- Compliance - ensuring conformance with information security policies, standards, laws and regulations
[edit] See also
 |
This computer-related article is a stub. You can help Wikipedia by expanding it. |
