Inventory the security controls around you
Find real controls at home or work and label each one by category (managerial, operational, technical, physical) and functional type.
Environment
Your home, or your workplace with your manager's OK. A spreadsheet.
Before you start
- Read Security Control Categories (p.18) and Functional Types (p.19).
You will
- Recognise controls in everyday settings
- Give every control two labels: category and functional type
Steps
-
1
Walk around your home or office and list at least 12 controls: locks, cameras, Wi-Fi password, antivirus, backup drive, a 'no tailgating' sign, a password policy, and so on.
-
2
In a spreadsheet, give each control a category: managerial, operational, technical or physical.
-
3
Give each one a functional type: preventive, detective, corrective, directive, deterrent or compensating. Some have two, e.g. a visible camera is detective and deterrent.
-
4
Find one gap: a risk with no control at all. Suggest a control for it and label that too.
-
5
Check your labels against the examples on p.18–20 of your guide.
Check your understanding
- ?Is a security awareness poster directive or deterrent? Justify it.
- ?Which of your controls would count as compensating, and what is it compensating for?