computer science

Security controls

Security controls is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Security controls rather than just read about it. In short: Security controls or security measures are safeguards or countermeasures to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets. In the field of information security, such controls protect the confidentiality, integrity and availability of information.

Key takeaways

Security controls belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Security controls to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Security controls from memory before moving on to harder problems.

Reference excerpt

Security controls or security measures are safeguards or countermeasures to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets. In the field of information security, such controls protect the confidentiality, integrity and availability of information. Systems of controls can be referred to as frameworks or standards. Frameworks can enable an organization to manage security controls across different types of assets with consistency. Security controls reduce the likelihood of any impacts of security incidents and protect the CIA triad for systems and data. While protecting it helps organizations meet their responsibilities, consistent risk management of systems, assets, data, networks and physical infrastructures.

Types of security controls Security controls can be classified by various criteria. One approach is to classify controls by how/when/where they act relative to a security breach, sometimes termed as control types:

Preventive controls are intended to prevent an incident from occurring e.g. by locking out unauthorized intruders; Sometimes known as firewalls or locked server rooms that restrict physical entry Detective controls are intended to identify, characterize, and log an incident e.g. isolating suspicious behavior from a malicious actor on a network or using network monitoring tolls to flag suspicious activity.; Compensating controls mitigate ongoing damages of an active incident, e.g. shutting down a system upon detecting malware After the event, corrective controls are intended to restore damage caused by the incident e.g. by recovering the organization to normal working status as efficiently as possible. Security controls can also be classified according to the implementation of the control (sometimes termed control categories), for example:

Physical controls - includes tangible items such as fences, doors, locks, CCTV systems and fire extinguishers; Procedural or administrative controls - e.g. incident response processes, management oversight, security awareness and training. Technical or logical controls - e.g. user authentication (login) and logical access controls, antivirus software, firewalls; Legal and regulatory or compliance controls - includes privacy laws, policies, regulations and clauses that help organizations handle and protect (e.g. HIPAA, GDPR). These classifications help organizations build a well-designed, multi-layered defense strategy, ensuring layers help control and prevent threats when they are being taking place.

Control effectiveness and lifecycle Security controls include both technical controls (such as access management and firewalls) and administrative controls (including policies and procedures). An effective controls testing and verification process allows:

Identifying safeguards that are protecting confidentiality, integrity, and availability of assets. Detailed overview of any security posture of the service. Contribution to any mitigation plans that may be prioritized for reducing risks arising because of any weaknesses or failures of controls Steps for assessment: Document security control implementation: securing infrastructure, configuring components, identifying & access management, security polices Monitor & verify security controls: Usually manual or automated testing and it tests penetration, reviewing logs, vulnerability scanning, any surveys and interviews with staff, and more. Reporting test results: Generating reports, metrics, trends Controls are part of a risk treatment strategy applied after risk assessment and designing, building, operating, and changing them is a part of the lifecycle.

Purpose in organizations University IT policy states that “Using a set of standardized controls allows IT security to ensure all University and Medical Center areas are protected from threats.” Controls in four basic categories: Computer Controls, Data Protection, Network Protections, User Authentication Computer Controls: Organizations may implement email protection, endpoint detection & response, centralized patch management, and domain membership. Data Protection: For protecting data organizations may equip full disk encryption and media destruction Network Protection: Protecting the network is important for keeping information safe from unwanted users. Organizations may use flow monitoring, logging network & system activity, network border protections and prohibit firewall to be bypassed to reduce an attack. User Authentication: Organizations may use two-factor authentication, may force users to change their passwords annually, have only authorized account management, and use a Local Admin Password Solution (LAPS).

Information security standards and control frameworks

The ISO/IEC 27000 series standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. The most recent version, ISO/IEC 27001;2022, released in October 2022, specifies 93 controls; some of the most well-known standards are outlined below.

International Standards Organization

ISO/IEC 27001:2022 was released in October 2022. All organizations certified to ISO 27001:2013 are obliged to transition to the new version of the Standard within 3 years (by October 2025). The 2022 version of the Standard specifies 93 controls in 4 groups:

A.5: Organisational controls A.6: People controls A.7: Physical controls A.8: Technological controls It groups these controls into operational capabilities as follows:

The previous version of the Standard, ISO/IEC 27001, specified 114 controls in 14 groups:

A.5: Information security policies A.6: How information security is organised A.7: Human resources security - controls that are applied before, during, or after employment. A.8: Asset management A.9: Access controls and managing user access A.10: Cryptographic technology A.11: Physical security of the organisation's sites and equipment A.12: Operational security A.13: Secure communications and data transfer A.14: Secure acquisition, development, and support of information systems A.15: Security for suppliers and third parties A.16: Incident management A.17: Business continuity/disaster recovery (to the extent that it affects information security) A.18: Compliance - with internal requirements, such as policies, and with external requirements, such as laws.

… excerpt ends here. Continue reading the full article.

Worked examples

Example 1 — a first encounter with Security controls

Start with the simplest possible case. Write down what Security controls claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Security controls before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Security controls ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Security controls

In research: Security controls appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Security controls in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Security controls is common in secondary-school and first-year university syllabi. It links to neighbouring topics Computer network security, Computer security procedures, Data security, so understanding it makes those chapters shorter.
In everyday life: Look for Security controls outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Ask Teacher Smith questions about this articleOpens your AI tutor with a question about “Security controls” →

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Security controls in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Security controls means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Security controls out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Security controls in simple terms?

Why does Security controls matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Security controls?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Security controls.