This provides a more balanced, organization-wide perspective on security, which can then be addressed by selectively deploying security technical controls. This problem is avoided by having the organizational security policy set technical control objectives based on risk management needs, compliance needs, and governance strategy (see the building blocks for risk management, compliance, and governance). Because of the complexity involved in deploying technical controls, it is not uncommon in small and under-resourced utilities to see security controls overbuilt in some areas and underbuilt in others ( Ingram and Martin 2017). Decisions regarding which controls to deploy and how the system of controls will work together (the security architecture) are made by the staff in charge of technical controls. The organizational security policy building block defines objectives for the technical controls building block. In such an arrangement, if an attacker breaches one control, controls at the next layer continue to provide protection. A common approach for deploying controls is defense-in-depth, where controls are layered. Technical controls must be organized in such a way that they provide protection for both data at rest (e.g., data stored on a hard drive) and data in motion (e.g., data moving across a network). Because they are so critical, some people think of technical controls as being the entirety of cybersecurity, ignoring other essential elements (those captured in the other building blocks). Technical controls perform many critical functions, such as keeping unauthorized individuals from gaining access to a system and detecting when a security violation has occurred. Firewalls, intrusion detection systems (IDS), encryption, and identification and authentication mechanisms are examples of technical controls (Harris and Maymi 2016). Technical controls are the hardware and software components that protect a system against cyberattacks.

Victoria hdd utility isolation