Category:Control - Revision history

MelDrews: typo correction

2015-06-09T01:13:55Z

typo correction

2015-05-24T17:48:44Z

Added external references

2015-05-24T17:38:55Z

Removed control examples pointing to standards and techniques; added examples referenced in acknowledged standards

2015-05-24T17:18:41Z

Correcting and expanding on definition of control with examples

2011-12-09T18:30:07Z

2011-02-07T23:05:11Z

Reverted edits by Frank Alexander (talk) to last revision by KirstenS

2011-02-07T21:31:48Z

2008-10-27T18:24:50Z

‎Examples of controls

2008-10-27T17:17:26Z

2008-10-27T17:16:42Z

‎Examples of controls

@@ Line 15: / Line 15: @@
 #Implement a Web Application Firewall (WAF)
 #Error checking all input
-#Use and automated scanner to look for security weaknesses
+#Use an automated scanner to look for security weaknesses
 #Output sanitization of error messages
 #Segregation development and production environments

@@ Line 55: / Line 55: @@
 *[[Data_Security]]
 *[[Integrity]]
 {{Template:PutInCategory}}

@@ Line 33: / Line 33: @@
 *Session Authenticity
-In most cases, NIST explicitly calls for the organization to define some of the elements of how these controls should be implemented.
+Note that three of these are included within the category of Access Controls. In most cases, NIST explicitly calls for the organization to define some of the elements of how these controls should be implemented.
 In contrast, the OWASP [[Session_Management_Cheat_Sheet]] does a very good job at illustrating session management implementation techniques and suggests some standards.  These kinds of standards and guidelines spell out specific implementation of controls.
@@ Line 52: / Line 52: @@
 *[[Authentication]]
 *[[Authorization]]
-*[[Session Management]]
+*[[Audit]]
-*[[Input Validation]]
+*[[Data_Security]]
-*[[Error Handling]]
+*[[Integrity]]
 {{Template:PutInCategory}}

@@ Line 4: / Line 4: @@
 ==What is a control==
-Controls are defensive technologies or modules that are used to detect, deter, or deny attacks. Necessary controls in an application should be identified using [[Threat modeling]] to ensure that the application is protected against common types of attacks based on the threats it faces. A weakness or design flaw of a control, or the lack of a necessary controls results in a vulnerability that can make the application susceptible to attacks.
+As an abstract category of concepts, it can be difficult to grasp where controls fit into the collection of policies, procedures, and standards that create the structures of governance, management, practices and patterns necessary to secure software and data.  Where each of these conceptual business needs is addressed through documentation with differing levels of specificity, it is useful to look at where controls fit in relation to these other structures.  Security controls can be categorized in several ways.  One useful breakdown is the axis that includes administrative, technical and physical controls.  Controls in each of these areas support the others.  Another useful breakdown is along the categories of preventive, detective and corrective.
 ==Examples of controls==

← Older revision		Revision as of 18:30, 9 December 2011
Line 1:		Line 1:
	This category is a parent category used to track categories of controls (or countermeasure, security mechanisms).		This category is a parent category used to track categories of controls (or countermeasure, security mechanisms).
		+
		+	{{Social Media Links}}

	==What is a control==		==What is a control==

@@ Line 1: / Line 1: @@
-== Modelo de Auditoría de sistemas:  ==
+This category is a parent category used to track categories of controls (or countermeasure, security mechanisms).
-Éste es un modelo universal para securizar en un alto grado de seguridad al sistema operativo.
+==What is a control==
-#Sistema de cifrado congelado: Mantiene en secreto la ubicación del archivo del sistema, previniendo ataques de tipo monitoreo de redes.
+==Examples of controls==
-#OpenVAS: Línea de comandos para cifrar- descifrar el protocolo TCP/Ip
+*[[Authentication]]
-#Filtro Web: Previene intrusiones a través de puertos inseguros
+*[[Authorization]]
-#Clam Antivirus: Previene, detecta y corrige virus informático
+*[[Session Management]]
-<br>
+{{Template:PutInCategory}}
-{| border="1" cellspacing="1" cellpadding="1" width="200" align="center"
+[[Category:Article Type]]
-|-
+[[Category:OWASP ASDR Project]]