Abstract
This chapter lists and explains the technical security controls that organizations must have to secure their assets. These controls implementation should be based on a zero trust model where all users, whether inside or outside the organization, need to be authenticated and authorized, and continuously identified to have access to corporate resources. Although these controls are essential to secure the organization, they are not enough to accomplish it. With these technical controls, organizations must also implement effective management and operational processes and hire qualified resources with the proper skills to implement, administer and operate these controls.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
- 2.
- 3.
Authors’ note: SSL and TLS are located into several layers of the OSI model or the TCP/IP model. TLS runs “on top of transport protocol (e.g., TCP) and encrypts payloads from higher layers. For a good discussion on this matter, please visit https://security.stackexchange.com/questions/93333/what-layer-is-tls/93338#93338.
- 4.
Although NAT is not a protocol, it is a method that can be implemented in the network layer.
- 5.
- 6.
- 7.
- 8.
- 9.
Stage of the TLS handshake where, in response to the ClientHello, the server sends a message containing the server’s SSL certificate, chosen cipher suite, and server random, and a random string of bytes generated by the server.
- 10.
- 11.
Bărbulescu v. Romania case. www.echr.coe.int/Documents/Press_Q_A_Barbulescu_ENG.PDF.
- 12.
For example, USA under Electronic Communications Privacy Act of 1986
- 13.
- 14.
- 15.
Author’s note: Never rely on extensions.
- 16.
When events are created for content that is allowed to egress.
- 17.
When events are not created for the content that is already exfiltrated.
- 18.
Please see Single Sign On.
- 19.
- 20.
No, not the Skynet. Merely the application accounts or service accounts are meant here.
- 21.
- 22.
- 23.
- 24.
- 25.
- 26.
- 27.
- 28.
- 29.
- 30.
- 31.
- 32.
Rivest, Ron L.; Shamir, Adi; Adleman, Len (February 1, 1978). “A Method for Obtaining Digital Signatures and Public-key Cryptosystems”. Communications of the ACM. 21 (2): 120–126. CiteSeerX 10.1.1.607.2677. doi:10.1145/359340.359342. ISSN 0001-0782. S2CID 2873616.
- 33.
- 34.
- 35.
- 36.
Author information
Authors and Affiliations
Rights and permissions
Copyright information
© 2022 The Author(s), under exclusive license to APress Media, LLC, part of Springer Nature
About this chapter
Cite this chapter
Viegas, V., Kuyucu, O. (2022). IT Security Technical Controls. In: IT Security Controls. Apress, Berkeley, CA. https://doi.org/10.1007/978-1-4842-7799-7_4
Download citation
DOI: https://doi.org/10.1007/978-1-4842-7799-7_4
Published:
Publisher Name: Apress, Berkeley, CA
Print ISBN: 978-1-4842-7798-0
Online ISBN: 978-1-4842-7799-7
eBook Packages: Professional and Applied ComputingApress Access BooksProfessional and Applied Computing (R0)