Question

What is the difference between requirements and controls in the security process? Give examples of each.

Answer 1

Answer:

Security controls are those measures taken to prevent, identify, counteract, and reduce security risks to computer systems, whereas, Security Requirements are guidelines or frameworks that stipulates measures to ensure security control.

Explanation:

Security controls encompass all the proactive measures taken to prevent a breach of the computer system by attackers. Security requirements are those security principles that need to be attained by a system before it can be certified as safe to use.

Security controls are of three types namely, management, operational, and technical controls. Examples of technical controls are firewalls and user authentication systems. A statement like 'The system shall apply load balancing', is a security requirement with an emphasis on availability.