Chapter 24 — Security architecture and engineering: controls

Chapter 24 — Security architecture and engineering: controls

Lesson map

Lesson 24 published. Map, example, EX070.

flowchart TD
  N0["Learning outcomes"]
  N1["24.1 Using a catalogue"]
  N2["24.2 Tailoring"]
  N3["24.3 Linking controls to risks"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX070"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["24.1 Using a catalogue"]
  N2["24.2 Tailoring"]
  N3["24.3 Linking controls to risks"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX070"]

[Learning outcomes]
    |
    v
[24.1 Using a catalogue]
    |
    v
[24.2 Tailoring]
    |
    v
[24.3 Linking controls to risks]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX070]

Learning outcomes

You will (1) select controls from a catalogue for Fernway; (2) tailor controls to a small organisation; (3) link controls to risks and owners.

24.1 Using a catalogue

Lucas uses NIST SP 800-53 Rev. 5 and ISO/IEC 27002:2022 as catalogues rather than checklists. He searches for controls that address the risks already recorded: access control, audit logging, configuration management, supplier relationships and incident response. Catalogues help him avoid forgetting whole areas, such as media disposal, which Fernway had never considered for old till hard drives. He keeps a short list of about thirty controls that matter for Fernway, instead of trying to implement hundreds written for much larger organisations. The short list is reviewed every year.

24.2 Tailoring

Each selected control is tailored to Fernway's size. The SP 800-53 audit review control becomes a monthly thirty-minute review of identity alerts by Hannah, not a security operations centre. Configuration management becomes a single baseline for laptops managed by the device tool. Supplier controls become a one-page questionnaire and a contract clause. Lucas records the tailoring reasons so that an auditor can see the control was considered and adapted deliberately. Tailoring is how frameworks become usable for organisations without large security teams.

24.3 Linking controls to risks

Lucas builds a table linking each control to the risks it reduces, its owner and its evidence, such as a review log or a configuration report. Controls with no linked risk are questioned; two turn out to be leftovers from a former insurer's requirements and are retired. Risks with no linked control are flagged as gaps. The table becomes Fernway's statement of how security is achieved and gives the board a way to follow progress without reading technical detail. It also makes later audits quicker.

Worked example

Lucas selects about thirty controls from SP 800-53 and ISO/IEC 27002, tailors them to Fernway's size and links each to risks, owners and evidence.

Synthetic case. Fernway's control list is synthetic; SP 800-53 Rev. 5 and ISO/IEC 27002:2022 are real.

Errors and limits

Tailoring can slide into weakening controls. Evidence must be real, not a promise.

Exercises

• EX070 — Forgotten area. Which area had Fernway never considered? Rubric: 3 = media disposal for old till hard drives;; 2 = disposal;; 1 = vague;; 0 = none.
• EX071 — Tailored audit review. How was audit review tailored? Rubric: 3 = a monthly thirty-minute review of identity alerts;; 2 = monthly review;; 1 = a security operations centre;; 0 = none.
• EX072 — Unlinked controls. What happened to controls with no linked risk? Rubric: 3 = questioned; two leftovers were retired;; 2 = retired;; 1 = kept;; 0 = none.

Synthesis

Catalogues prevent omissions; tailoring and risk links make controls fit a small organisation.

Continue studying — chapter 24 of 40

← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →