Identity and access management

Identification (an identifier, typically the username of a system account, identifies the individual, group, role, service, or device), authentication (verifying that identity), authorization (determining whether it is permitted to access an asset), and accountability (mapping an activity back to the responsible party). Access should follow least privilege and need to know, be approved before accounts are created, and be disabled promptly on termination, with credentials revoked.[2][3][4][5][6][7]

Periodic access reviews

Accounts are reviewed on a set schedule for compliance with account management requirements, and the privileges assigned to users are reviewed periodically to validate the need for them, with privileges reassigned or removed where necessary. The auditor tests whether reviews happened, whether the reviewer had the authority to decide, and whether inappropriate access found in the review was actually removed. Accounts of terminated or transferred users that were never disabled are a typical finding.[6][7][8]

Multi-factor authentication

Requires more than one distinct type of authentication factor: something you know, something you have, something you are. Two passwords are still a single factor type, so they are not MFA. NIST SP 800-63B-4 is the current NIST reference for authenticators and assurance levels.[9][10]

Encryption and digital signatures

Symmetric encryption uses one shared key and is significantly faster, so it protects large amounts of data; asymmetric (public/private key pair) cryptography needs fewer keys overall, so it is used for digital signatures and to establish symmetric keys. A signature is generated with the signer's private key and verified with the matching public key, giving the recipient assurance of the sender's identity and the data's integrity, and it can provide nonrepudiation. Key management, often an afterthought, is frequently where the weakness is.[11][12][13][14]

Physical and environmental controls

Physical access authorizations are enforced at entry and exit points, environmental levels such as temperature and humidity are maintained and monitored, water near systems is detected, a UPS bridges power loss long enough for an orderly shutdown or a switch to alternate power, and fire detection and suppression systems, such as sprinkler systems and smoke detectors, protect data centers and are supported by an independent energy source. Clean agents are gases that do not conduct electricity and leave no residue.[15][16][17][18][19]

Data classification and DLP

The information owner is responsible for establishing controls, including classification. Classification assigns a sensitivity level to data, and each level specifies the controls that apply. Data loss prevention identifies, detects, and helps prevent unsafe or inappropriate sharing, transfer, or use of sensitive data. Protecting data depends on knowing where it is: organizations identify and document the location of information and the system components on which it is processed and stored.[20][21][22]

Security monitoring and evidence handling

A SIEM gathers security data from system components and presents it as actionable information in one place; audit records are reviewed for inappropriate or unusual activity and findings reported. Logs must be protected from alteration, including by privileged users who are themselves the subject of the audit. During an investigation, evidence must be handled with a documented chain of custody, or it can be discredited.[23][24][25][26]

Authentication vs. authorization

Authentication verifies who you are; authorization determines whether you are permitted to access an asset once your identity is verified. A user who logs in correctly but can reach data outside their role is an authorization failure, not an authentication one.[3]

Vulnerability scan vs. penetration test

A vulnerability scan is automated, identifying outdated software, missing patches, and misconfigurations by matching what it finds against a database of known vulnerabilities. A penetration test mimics real-world attacks, often launching real attacks against real systems to find ways around security features. A penetration test needs documented management approval and agreed rules before it begins.[27][28][29]

IDS vs. IPS

An intrusion detection system inspects activity and identifies suspicious patterns, often from a passive sensor watching a copy of the traffic. An intrusion prevention system also stops attacks, typically with an inline sensor that all traffic passes through, which is why prevention actions are tuned before being enabled, to avoid blocking benign activity on a false positive. With an IDS, someone still has to act on the alert.[30][31][32][33]