Reference no: EM134015152
How does each control/actions address achieving/maintaining Confidentiality, Integrity, or Availability.
1. Physical security
Control 1: Putting in place access restrictions for limited locations, such as keyless entry systems, access cards, or biometric authentication.
Control 2: Setting up alarms and surveillance cameras to track and stop any unauthorised entry attempts.
2. Perimeter Security
Control 1: Using firewalls to filter and block undesired incoming and outgoing network traffic is control number one.
Control 2: Monitoring network activity for suspicious behaviour and potential assaults using intrusion detection and prevention systems (IDPS).
3. Network Security
Control 1 : Use of Virtual Private Networks (VPNs) to encrypt data transactions between remote sites and the main network .
Control 2: Setting up VLANs and network segmentation to separate sensitive data from unrelated network traffic.
4. IAM Layer
Control 1 ; Implementing multi-factor authentication (MFA) as a second layer of security on top of passwords .
Control 2: Updating user credentials on a regular basis and enforcing strong password restrictions.
5. Data Security
Control 1 : Data encryption at rest and in transit using reliable encryption techniques.
Control 2 : Implementing data loss prevention (DLP) tools to track and stop unauthorised exfiltration of sensitive data is control number two.
6. Application Security
Control 1: To find and address potential security problems, conduct routine code reviews and security testing.
Control 2 ; Cross-site scripting (XSS) and SQL injection are two prevalent web-based assaults that can be prevented by implementing web application firewalls (WAFs).
7. End-User Security
Control 1: Educating staff members on security to help them spot and counteract social engineering tactics.
Control 2: Enacting email filtering and sandboxing to stop harmful attachments and phishing emails from getting to end users.