Security Control
Security Control: A technical, organizational, or physical measure used to reduce a security risk. It should be documented, assigned to an owner, measured, and reviewed at defined intervals.
How it works and where it fits
Security Control is a preventive, detective, or corrective security control. Its effect depends on where it sits in the architecture, which data and decisions it processes, and how it might be bypassed. A control reduces a defined risk but rarely removes it completely, so it should be combined with additional layers of protection.
Practical security relevance
Before deployment, the objective, ownership, coverage, and expected behavior should be defined. Secure defaults, controlled exceptions, logging, and periodic effectiveness tests matter more than installation alone. Operational metrics should expose both blocked or detected activity and gaps, false alerts, and effects on legitimate business processes.
Related concepts
- Security Control ValidationSecurity Control ValidationPractical verification of whether security measures are effective as intended.: Practical verification of whether security measures are effective as intended.
- Compensating ControlCompensating ControlCompensating measure that reduces risk when a primary control is not feasible.: Compensating measure that reduces risk when a primary control is not feasible.
- Risk MitigationRisk MitigationMeasures that reduce the likelihood or impact of an identified risk.: Measures that reduce the likelihood or impact of an identified risk.
- Defense in DepthDefense in DepthCombines multiple independent security controls to create layered protection.: Combines multiple independent security controls to create layered protection.