I once was in a situation in a relationship where I felt like I had no control over whether or not that person hurt me. But no matter what I did, I had no sense of control over the situation. All of my defense mechanisms kicked in and I sought to gain control over the situation. And doing so only made things worse and that relationship even harder. Sometimes the desire for control can drive us to do crazy things. It’s not wrong to seek to be a good steward of the responsibilities we are given, even if we acknowledge that we aren’t ultimately in control. We have to acknowledge the same problem with security controls.

In Information Security, there’s a great deal of ways of thinking about controls. But as I study for the CompTIA Security+ test, I’m introduced into categories of controls that help organize the various types of controls and helps strategically think through the controls that need to be in place. And the entire time I’m studying these, I’m encouraged to find so many people have already thought so deeply about how to be good stewards of what we’ve been given. These controls acknowledge our responsibility in caring for the resources we’re given.

Security Controls

Security Categories: TMOP

TMOP is the acronym I use to remember the control categories listed in the Security+; Technical, Managerial, Operational, and Physical. My visual cue is a mop with a T on it; T being my first initial and a mop. Technical obviously involves controls that require a technical solution (firewall, software to detect other software that may be malicious, etc.). Managerial is the decisions that have to be made by management; policies, risk assessments, background checks, etc.. Operational are the controls like training and incident response plans that are created to help the organization operate in a secure way. Then there is physical that includes things like locks, guards, cameras, fences, etc..

When I worked at a previous employer, I was responsible for making sure that our managed service provider had all the technical controls in place and that they were working adequately. And when there were alerts regarding the health of those controls, I was usually checking in with our managed service provider to make sure that these vulnerabilities were known and being mitigated in some way (that’s called risk management). When it came to the managerial side of things, I crafted and designed the managerial controls related to technology (and even some controls that were more about the overall security of things) that the organization used to help protect itself from becoming too apathetic about security (the law of entropy leans into this idea that if we don’t put energy into something, it’ll decay). These included policies on how information was handled, who had access to different types of information, and how risk assessments were handled.

I also helped craft and implement the operational controls. It included information security training for employees, taught them how to use our password manager, monitored how the phishing email campaigns went, and even created incident response plans and disaster recovery plans from scratch. I think this side of things was my favorite part of helping secure our organization. Knowing practical things were actually being implemented and taught to employees meant that the controls I encouraged were actually being implemented.

Finally, the physical controls were the piece that were the least desired for some reason. I would have suspected that these controls would have been some of the first controls embraced, but the industry was a relational industry and they saw the physical controls as a barrier to maintaining business. Despite this, many areas where we had branches had crime factors that were pushing for the need for physical controls that were previously not a consideration. It was something I had pushed for, but not gotten much progress on before leaving.

Security Control Types: PDDCCD

Then there are the control types. I don’t have a great mnemonic for this one yet. PDDCCD as an acronym seems like a decent enough pattern that it seems to stick in my mind without me coming up with a visual cue, but I’m sure I’m going to try to figure a visual mnemonic at some point. If I do, I’ll try to update it here. But the types are explanations more about the stage the control is useful in. Preventive, Deterrent, Detective, Corrective, Compensating, and Directive. Just from their names, you get an idea of where they fall in the grand scheme of things. But let me try to clarify some stuff that’s not incredibly clear.

Preventive and Deterrent are both before the malicious party seeks to attempt a hack. Preventive are controls that seek to prevent hackers from hacking with actual security measures (passwords, fences around the property, Intrusion Prevention Systems). Deterrents are more of an attempt to dissuade hackers from hacking (warning banners, visible cameras, guard booths). Detective controls are those that discover an active (or having just been completed) hack. These include Intrusion Detection Systems, audit logs, and a Security Operations Center or Security Incident and Event Management system.

Corrective are meant to be a way to recover from a hack (backups, hot sites, patching). Compensating are alternative controls that help cover for controls that aren’t possible and span the breadth of the time span from before a hack to after a hack. The final one, Directive, is ongoing throughout the process. It is what is supposed to guide behavior of everyone involved (policies, training, etc.).

Knowing these types and categories of security controls can be really helpful in being strategic about how you protect the organizations you’re a part of. They even help to think about your own family’s safety if you want to be thorough with that as well. We’re all striving for control in some way shape or form.

And as I said before, it’s good to attempt to control the things that are in our control. But with a caveat; we cannot allow our desire to control to become what controls us. We must acknowledge that there are things that are just out of our control. Security controls only work to an extend which is why the “it’s not if but when” phrase comes in when talking about being hacked. Be good stewards, be diligent in your responsibilities and stewardship, but accept that not everything is in your control. It’s actually quite freeing.

In undergrad, I learned about a concept called “locus of control”. Where does a person think that the control for their life lives? Is it in them or is it something that happens to them? Internal locus of control versus external. I believe there is a third option, a biblical option. A balance between God being in control, and him giving us responsibility and stewardship. It’s a paradox, but one that we can embrace as being the best of both worlds. God is ultimately in control and as such he calls us to be faithful with what he has given us. We are unable to do anything that would undermine his sovereignty, but he still holds us accountable to being faithful.