Êtes-vous un étudiant de l'EPFL à la recherche d'un projet de semestre?
Travaillez avec nous sur des projets en science des données et en visualisation, et déployez votre projet sous forme d'application sur GraphSearch.
Concept
Security controls
Résumé
Security controls are safeguards or countermeasures to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets. In the field of information security, such controls protect the confidentiality, integrity and availability of information.
Systems of controls can be referred to as frameworks or standards. Frameworks can enable an organization to manage security controls across different types of assets with consistency.
Security controls can be classified by various criteria. For example, controls are occasionally classified by when they act relative to a security breach:
Before the event, preventive controls are intended to prevent an incident from occurring e.g. by locking out unauthorized intruders;
During the event, detective controls are intended to identify and characterize an incident in progress e.g. by sounding the intruder alarm and alerting the security guards or police;
After the event, corrective controls are intended to limit the extent of any damage caused by the incident e.g. by recovering the organization to normal working status as efficiently as possible.
Security controls can also be classified according to their characteristics, for example:
Physical controls e.g. fences, doors, locks and fire extinguishers;
Procedural or administrative controls e.g. incident response processes, management oversight, security awareness and training;
Technical or logical controls e.g. user authentication (login) and logical access controls, antivirus software, firewalls;
Legal and regulatory or compliance controls e.g. privacy laws, policies and clauses.
For more information on security controls in computing, see Defense in depth (computing) and Information security
Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. Some of the most well known standards are outlined below.
ISO/IEC 27001:2022 was released in October 2022.
Source officielle
À propos de ce résultat
Cette page est générée automatiquement et peut contenir des informations qui ne sont pas correctes, complètes, à jour ou pertinentes par rapport à votre recherche. Il en va de même pour toutes les autres pages de ce site. Veillez à vérifier les informations auprès des sources officielles de l'EPFL.
Concepts associés (5)
Security service (telecommunication)
Security service is a service, provided by a layer of communicating open systems, which ensures adequate security of the systems or of data transfers as defined by ITU-T X.800 Recommendation. X.800 and ISO 7498-2 (Information processing systems – Open systems interconnection – Basic Reference Model – Part 2: Security architecture) are technically aligned. This model is widely recognized A more general definition is in CNSS Instruction No.
Security controls
Security controls are safeguards or countermeasures to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets. In the field of information security, such controls protect the confidentiality, integrity and availability of information. Systems of controls can be referred to as frameworks or standards. Frameworks can enable an organization to manage security controls across different types of assets with consistency.
Sécurité de l'information
vignette|alt=Symbole de sécurité de l'information|Symbole de sécurité de l'information. La sécurité de l'information est un ensemble de pratiques visant à protéger des données. La sécurité de l'information n'est confinée ni aux systèmes informatiques, ni à l'information dans sa forme numérique ou électronique. Au contraire, elle s'applique à tous les aspects de la sûreté, la garantie, et la protection d'une donnée ou d'une information, quelle que soit sa forme.
Cours associés (3)
COM-402: Information security and privacy
This course provides an overview of information security and privacy topics. It introduces students to the knowledge and tools they will need to deal with the security/privacy challenges they are like
CS-119(c): Information, Computation, Communication
L'objectif de ce cours est d'introduire les étudiants à la pensée algorithmique, de les familiariser avec les fondamentaux de l'Informatique et de développer une première compétence en programmation (
EE-552: Media security
This course provides attendees with theoretical and practical issues in media security. In addition to lectures by the professor, the course includes laboratory sessions, a mini-project, and a mid-ter