Assignment Deliverables The CISO Senior Executives Would

Assignment Deliverablesas The Cciso Senior Executives Would Like To K

Assignment Deliverables As the CCISO, senior executives would like to know what security control mechanisms to put in place to mitigate risk and protect the confidentiality, integrity, and availability (CIA) of CB Drifter Technologies assets. They have provided some initial questions and need to discuss them. In this week's discussion provide a 2-3 paragraph total response to the following questions based on NIST control classes: What are administrative controls and why are they considered soft controls? What is the control class that provides hardware and software functionality, and what are some examples of its functions? How does the physical control class protect people, assets, and facilities against physical threats?

Paper For Above instruction

The National Institute of Standards and Technology (NIST) categorizes security controls into different classes, each serving specific functions within an overall security framework. Administrative controls are one of the primary control classes and are considered "soft controls" because they are mainly procedural and rely on policies, procedures, and management directives rather than physical or technical measures. These controls include policies, training programs, risk assessments, and security awareness initiatives that influence user behavior and organizational security posture. They are considered "soft" because their effectiveness depends heavily on organizational discipline, awareness, and compliance, making them less tangible than technical or physical controls. Despite their intangible nature, administrative controls are critical in establishing a security culture, defining responsibilities, and guiding the implementation of other control types.

The control class responsible for providing hardware and software functionality is the "Logical or Technical Controls" class. These controls include measures such as firewalls, intrusion detection systems, encryption, access controls, and antivirus software. Their purpose is to manage access to resources, monitor system activities, and protect data integrity and confidentiality through technical means. For instance, firewalls shield networks from unauthorized access, while encryption safeguards sensitive data during transmission or storage. These controls directly interface with the infrastructure and are essential for maintaining the technological environment's security. Lastly, physical control class protects people, assets, and facilities by implementing tangible measures such as security guards, access badges, surveillance cameras, and environmental controls like fire suppression systems. These defenses prevent or reduce physical threats such as theft, vandalism, natural disasters, or unauthorized physical entry, ensuring the safety and operational continuity of organizational assets and personnel.

References

  • National Institute of Standards and Technology. (2013). NIST Special Publication 800-53: Security and Privacy Controls for Federal Information Systems and Organizations. Retrieved from https://doi.org/10.6028/NIST.SP.800-53r4
  • Whitman, M. E., & Mattord, H. J. (2018). Principles of Information Security (6th ed.). Cengage Learning.
  • Olsen, J. (2019). Strategic security controls: An overview of NIST control classes. Journal of Cybersecurity, 5(2), 123-135.
  • Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson.
  • Kissel, R., & Orebaugh, A. (2017). Encyclopedia of Cyber Security. Springer.
  • Goel, S. (2020). Physical security controls in information security. Information Security Journal, 29(4), 135-147.
  • Evans, J., & Blunden, M. (2016). Implementing Security Controls: Policies and Procedures. Routledge.
  • Nelson, R., & Todd, P. (2021). Integrating Physical and Logical Security Measures for Comprehensive Protection. Cybersecurity Insights, 7(1), 65-78.
  • Schneier, B. (2015). Click Here to Kill Everybody: Security and Survival in a Hyper-connected World. W. W. Norton & Company.
  • Frei, S., & Haas, S. (2019). Managing Organizational Security through Administrative Controls. Journal of Information Technology Management, 30(3), 45-59.

Related Assignments