Security controls and defence in depth

By the end of the first walk-through, Sam's notebook held a long list of problems: a payroll account with no second factor, the music box on the point-of-sale network, a former barista's shop login, a back door propped open on delivery days, backups nobody had tested since spring. Rosa's reasonable question was where to start. Answering it needs two tools. The first is a vocabulary for security controls, so that each fix can be described and compared. The second is a simple way of scoring risks so that the most dangerous problems are tackled first. This lesson covers both, along with the idea that ties them together: defence in depth.

What a control is

A security control is any measure that reduces risk. Controls can be technology, such as a firewall or encryption; procedures, such as phoning a supplier before changing bank details; or physical measures, such as a lock. A control can reduce the likelihood that something bad happens, reduce the impact when it does, or help the organization notice and recover. Thinking about controls in a structured way helps make sure nothing important is missing, and it is the language auditors, insurers and certification exams use.

Controls are usually described in two ways at once: by category, which says what kind of control it is, and by type, which says what it does. Every control has both. A door lock is a physical control (category) that is preventive (type). A security camera is a physical control that is mainly detective, and its visible presence also deters.

Control categories

Technical controls, sometimes called logical controls, are implemented in hardware or software: firewalls, encryption, multi-factor authentication, antivirus, access permissions and logging. Managerial controls, sometimes called administrative controls, are the decisions and documents that direct security: policies, risk assessments, the rules for who may approve payments, and the plan for reviewing access every quarter. Operational controls are carried out day to day by people: checking that backups ran, training staff, reviewing logs, locking up at night. Physical controls protect the real world: locks, fences, badges, cameras, a safe for the cash float and the cable lock on the roaster laptop.

Small organizations tend to lean on technical controls and forget the others, but the managerial and operational controls are what keep technical ones working. A backup system is a technical control; checking each Monday that it ran, and testing a restore every month, are the operational controls that make it trustworthy.

Control types

Preventive controls stop an incident from happening: a firewall rule that blocks a connection, MFA that blocks a stolen password, a locked door. Detective controls discover that something is happening or has happened: log alerts, cameras, the bank's notification of a large payment, a monthly review of who has access. Corrective controls limit damage and restore normal operation after an incident: restoring from backup, reimaging an infected computer, patching the vulnerability that was exploited. Deterrent controls discourage attackers: warning signs, visible cameras, a login banner stating that activity is monitored. Directive controls tell people what to do: policies, signs and procedures, such as the rule to verify bank detail changes by phone. Compensating controls are alternatives used when the preferred control is not possible, such as extra monitoring on an old till that cannot be updated until it is replaced.

Most good security programs include all types. Prevention is never perfect, so detection matters; detection is useless without the ability to correct; and directive and deterrent controls shape behaviour so that fewer incidents start.

TYPE = {
    "multi-factor authentication": "preventive",
    # add: log alert for failed sign-ins, restore from backup, locked back office, monthly access review
}

def control_type(name):
    return TYPE.get(name, "unknown")

for c in ["multi-factor authentication", "log alert for failed sign-ins", "restore from backup"]:
    print(c, "->", control_type(c))

Defence in depth

Defence in depth means using several independent layers of controls, so that if one fails, another still stands between the attacker and the asset. The idea comes from castle design: a moat, an outer wall, an inner wall and a keep, each of which an attacker must defeat in turn. In IT security the layers usually run from policies and people on the outside, through physical security, the network, each device and each application, to the data itself in the centre.

Consider how the layers would have handled the payroll phishing email if Anita had clicked. Email filtering, the first layer, had already failed, since the message arrived. Training was the next layer, and it is the one that worked: Anita noticed the odd address. Had she entered her password, MFA would have been the next layer, stopping a sign-in from the criminals' location. Had that also failed, the payroll provider's alert on bank detail changes, and Ridgeline's rule of confirming such changes by phone, would have caught the fraud before payday. No single layer is perfect; together they make success very unlikely.

Defence in depth also means avoiding single points of failure in the security itself. If the only thing protecting the shop's admin page is one password, everything depends on that password. If one person is the only one who can restore backups, everything depends on that person being available. Diversity helps too: using different kinds of control (technical, procedural, physical) means a single trick is unlikely to defeat them all.

Measuring risk

Lesson 1 defined risk as the combination of likelihood and impact. To compare risks, many organizations score each on a simple scale, often 1 to 5, and multiply the two numbers. Likelihood runs from 1 (rare, might happen once in many years) to 5 (almost certain, expected this year). Impact runs from 1 (minor inconvenience) to 5 (severe: large financial loss, a long outage, regulatory action or lasting damage to reputation). A risk scored 5 for likelihood and 5 for impact scores 25, the maximum; a rare, minor risk scores 1.

This kind of scoring is called qualitative, because the numbers represent judgments rather than measurements. It is imprecise, but it is fast, easy to explain and good enough to put risks in a sensible order. Larger organizations sometimes use quantitative methods, estimating the cost of each incident and how often it might occur per year, and multiplying them to get an expected annual loss. For example, if a laptop theft would cost about 3,000 dollars in hardware and recovery time and is expected roughly once every five years, the annualized loss is about 600 dollars a year, which helps decide whether a 100-dollar encryption and tracking setup is worth it.

risks = [
    ("Payroll account taken over by phishing", 4, 5),
    ("Ransomware on OFFICE-01", 3, 5),
    ("Former staff account misused", 3, 3),
    ("Music box on point-of-sale network", 3, 4),
    ("Roaster laptop stolen from car", 2, 3),
]
for name, likelihood, impact in sorted(risks, key=lambda r: -(r[1] * r[2])):
    score = likelihood * impact
    level = "high" if score >= 15 else "medium" if score >= 8 else "low"
    print(f"{score:>2} {level:<6} {name}")

20 high   Payroll account taken over by phishing
15 high   Ransomware on OFFICE-01
12 medium Music box on point-of-sale network
 9 medium Former staff account misused
 6 low    Roaster laptop stolen from car

risks = [
    ("Payroll phishing", 4, 5),
    ("Unlocked back door", 3, 3),
    ("Old router firmware", 3, 4),
    ("Coffee spilled on NAS", 1, 4),
]

def rank_risks(risks):
    rows = []
    for name, likelihood, impact in risks:
        score = likelihood * impact
        level = "low"  # fix this
        rows.append((score, level, name))
    return rows

for row in rank_risks(risks):
    print(row)

def annual_loss(cost, every_years):
    # incidents per year = 1 / every_years
    return 0

def worth_it(cost, every_years, control_cost_per_year):
    return False

print(annual_loss(3000, 5))
print(worth_it(3000, 5, 100))

Treating risk

Once risks are scored, each one gets a decision. There are four standard responses. Mitigate, the most common, means applying controls to reduce the likelihood or impact, such as adding MFA to the payroll account. Transfer means shifting some of the impact to someone else, usually through insurance or a contract; Ridgeline is considering a cyber insurance policy, and its card payments already transfer some risk to the payment provider. Avoid means stopping the activity that causes the risk, such as no longer storing scanned copies of employees' identity documents on the office PC. Accept means consciously deciding to live with a risk because it is low or because fixing it costs more than it saves, and recording that decision so it can be reviewed later.

The risk left after controls are applied is called residual risk. The aim is not zero but a residual risk the business is comfortable with, which is called its risk appetite or tolerance. Rosa's appetite is low for anything touching card data, payroll or the bank, and higher for minor inconveniences. That guidance lets Sam and Jordan make decisions without asking her about every item.

Security frameworks

Organizations rarely invent their control lists from scratch. They use frameworks: published, well-tested collections of controls and practices. The NIST Cybersecurity Framework, from the US National Institute of Standards and Technology, organizes security into six functions: govern, identify, protect, detect, respond and recover. The CIS Controls from the Center for Internet Security list prioritized safeguards and group the most essential ones for small organizations. ISO/IEC 27001 is an international standard for an information security management system, which organizations can be certified against. In Canada, the Canadian Centre for Cyber Security publishes baseline security controls aimed at small and medium organizations. Ridgeline will use a short checklist drawn from these in the capstone; CYB-260 covers frameworks in depth.