Security and Privacy Controls for Information Systems and Organizations¶
Ross, R., Pillitteri, Dempsey, Riddle, & Guissanie, G. (2020). Security and Privacy Controls for Information Systems and Organizations.
Cited by¶
24 citations across 24 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Access Control
- Access control is the mechanism and policy by which a system decides whether a particular principal (user, process, service, device) may perform a particular action (read, write, execute, modify, delete) on a particular resource (file, record, endpoint, physical space, function) at a particular moment — enforcing a security policy that separates authorized from unauthorized access and is the primary technical implementation of confidentiality, integrity, and need-to-know principles
This sourceThe Access Control (AC) family — AC-3 Access Enforcement, AC-6 Least Privilege, plus account management and continuous monitoring — is the canonical control catalog implementing authorization, need-to-know, and least privilege.
Supported in partVerified against the work's full text
NIST AC-3 states that systems enforce authorizations for subjects' access to objects per access control policy, and AC-6 gives least privilege; it does not call access control the primary implementation of confidentiality and integrity.
“Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.”
- Access control is the mechanism and policy by which a system decides whether a particular principal (user, process, service, device) may perform a particular action (read, write, execute, modify, delete) on a particular resource (file, record, endpoint, physical space, function) at a particular moment — enforcing a security policy that separates authorized from unauthorized access and is the primary technical implementation of confidentiality, integrity, and need-to-know principles
- Defense In Depth
- In cybersecurity, the pattern stacks perimeter firewalls, network segmentation, host hardening, encryption, monitoring, and least-privilege identity so that a phished credential does not reach the database.
This sourceSpecifies layered, defense-in-depth security controls and the principle of diversifying control types so layers fail for independent reasons.
Supported in partVerified against the work's full text
NIST supports diversity as an independence move (different OS, different code bases, mixed physical and procedural safeguards) but not common-cause analysis or the nuclear-security equivalence.
“Storing auditing information on a system component running a different operating system reduces the risk of a vulnerability specific to the system”
- In cybersecurity, the pattern stacks perimeter firewalls, network segmentation, host hardening, encryption, monitoring, and least-privilege identity so that a phished credential does not reach the database.
- Indirection
- Listed in the references but not attached to a specific claim.
- Record-Reality Divergence
- … the record overstating entitlement (a departed employee whose access was never revoked retains live credentials), so the security stakes push cadence toward continuous reconciliation and event-driven write-through (deprovision synchronously on the HR termination event rather than waiting for the quarterly review
This sourceRequires aligning account management with personnel termination/transfer and disabling accounts within a defined period — the event-driven (write-through) deprovisioning that prevents an access-control record from overstating entitlement after employment ends.
Supported in partVerified against the work's full text
AC-2 requires account management aligned with termination and notification/disabling within a defined time; it does not mandate synchronous write-through or continuous reconciliation.
“l. Align account management processes with personnel termination and transfer processes.”
- … the record overstating entitlement (a departed employee whose access was never revoked retains live credentials), so the security stakes push cadence toward continuous reconciliation and event-driven write-through (deprovision synchronously on the HR termination event rather than waiting for the quarterly review
- Separation of Powers
- In information security and internal control, separation of duties (SoD) is the principle that no single individual should have authority to execute, approve, and audit the same transaction—operationalized in NIST Special Publication 800-53 (2020) as control AC-5, which requires organizations to identify duties of individuals requiring separation, define information system access authorizations to support separation, and document the separation of duties in policies and procedures.
This sourceControl AC-5 ("Separation of Duties") requires organizations to identify duties requiring separation, define information system access authorizations to support separation, and document the policy in procedures—the canonical operational standard for security separation of duties.
Supported in partVerified against the work's full text
SP 800-53 Rev. 5 AC-5 requires identifying duties needing separation and defining access authorizations to support it; no 'execute, approve, audit' wording or policy-documentation clause.
“Define system access authorizations to support separation of duties.”
- In information security and internal control, separation of duties (SoD) is the principle that no single individual should have authority to execute, approve, and audit the same transaction—operationalized in NIST Special Publication 800-53 (2020) as control AC-5, which requires organizations to identify duties of individuals requiring separation, define information system access authorizations to support separation, and document the separation of duties in policies and procedures.
Domain-specific¶
Mechanisms¶
- Access and Credential Partition
- … hygiene is that it is additive for the actor and subtractive for outsiders — it guarantees the zone a sufficient, self-contained path rather than minimizing everyone's access, and it deliberately preserves narrow, alarmed break-glass routes so the seal never becomes a way to lock legitimate emergency response out.
This sourceProvides separately managed, rapidly activated emergency accounts and calls for monitoring and automatic disabling after a defined period.
- … hygiene is that it is additive for the actor and subtractive for outsiders — it guarantees the zone a sufficient, self-contained path rather than minimizing everyone's access, and it deliberately preserves narrow, alarmed break-glass routes so the seal never becomes a way to lock legitimate emergency response out.
- Access Control or Permissioning
- This keeps the blast radius of any one compromised or mistaken actor small.
This sourceExplains that least privilege limits a component's scope of action and minimizes the security impact of failure or misuse.
- This keeps the blast radius of any one compromised or mistaken actor small.
- Access Revocation Pass
- Its strength is that it directly attacks privilege creep
This sourceRequires periodic review of assigned user privileges and removal when their original need can no longer be validated.
- Its strength is that it directly attacks privilege creep
- Admin Console
- The classic misuse is treating the console's roles as decoration — everyone quietly gets admin because fine roles were annoying to maintain — which collapses separation of duties and lets a single compromised or careless account move everything.
This sourceRequires role-based separation of duties and restricts privileged accounts to designated personnel or roles.
- The classic misuse is treating the console's roles as decoration — everyone quietly gets admin because fine roles were annoying to maintain — which collapses separation of duties and lets a single compromised or careless account move everything.
- Audit Log
- A log that records what changed but not why gives thin assurance; a log that can itself be edited gives false assurance — the appearance of an audit trail with none of the protection, so non-repudiation quietly fails.
This sourceRequires audit records to be protected from modification and ties non-repudiation to irrefutable, identity-bound evidence of actions.
- A log that records what changed but not why gives thin assurance; a log that can itself be edited gives false assurance — the appearance of an audit trail with none of the protection, so non-repudiation quietly fails.
- Collapse Prevention Plan
- Designed with defense-in-depth,
This sourceExplains that layered protections can keep a system secure after one protective mechanism fails.
- Designed with defense-in-depth,
- Coordinated Approval Workflow
- Its strength is enforcing separation of duties
This sourceRequires identifying and documenting duties that must be separated and defining access authorizations to enforce that separation.
- Its strength is enforcing separation of duties
- Data Loss Prevention Policy
- As a layer of defense in depth
This sourceDefines defense in depth as coordinated, layered controls that reinforce one another and make successful attack harder.
- As a layer of defense in depth
- Integrity Monitor
- Its strength is that it is the only mechanism here whose job is to see what the guards missed: a detective control that catches violations from bugs, races, manual edits, and adversarial bypass that no single preventive check anticipated, and it supplies the drift evidence needed to fix stale guards.
This sourceSpecifies integrity monitoring to detect unauthorized changes and feed detected events into response and correction.
- Its strength is that it is the only mechanism here whose job is to see what the guards missed: a detective control that catches violations from bugs, races, manual edits, and adversarial bypass that no single preventive check anticipated, and it supplies the drift evidence needed to fix stale guards.
- Out-of-Band Channel
- When the next identity outage hits, responders dial the bridge, read live device telemetry over the out-of-band link, and drive the recovery — because the channel they are using was designed to survive the failure domain that swallowed everything else.
This sourceDefines out-of-band channels as separate paths that remain unaffected when the in-band channel is compromised or unavailable.
- When the next identity outage hits, responders dial the bridge, read live device telemetry over the out-of-band link, and drive the recovery — because the channel they are using was designed to survive the failure domain that swallowed everything else.
- Permission–Entitlement Crosswalk
- Its named risk is privilege creep — permissions that accumulate past their warrant as roles evolve, integrations linger, and exceptions ossify, until the access map no longer reflects any legitimate entitlement.
This sourceRequires least privilege and account or authorization review so access remains limited to current role and task needs.
- Its named risk is privilege creep — permissions that accumulate past their warrant as roles evolve, integrations linger, and exceptions ossify, until the access map no longer reflects any legitimate entitlement.
- Policy Guardrail
- Its strength is preserving rights and separation of duties across delegation
This sourceRequires separation of duties and visible, accountable handling of authorized exceptions rather than informal workarounds.
- Its strength is preserving rights and separation of duties across delegation
- Rule Application Audit Log
- Its integrity guarantee is why non-repudiation matters: a trace no one can later deny or silently edit.
This sourceRequires audit records to resist unauthorized modification and uses attributable records to support non-repudiation.
- Its integrity guarantee is why non-repudiation matters: a trace no one can later deny or silently edit.
- Service Account or Bot Delegate
- Least-privilege scoping is the animating safeguard, but privilege creep and secret sprawl erode it silently.
This sourceRequires processes and users to receive only the authorized access necessary to perform assigned tasks.
- Least-privilege scoping is the animating safeguard, but privilege creep and secret sprawl erode it silently.
- Verification Hold Point
- The discipline is separation of duties over who may waive, and logging every waiver as a first-class, reviewable event so overrides are visible rather than silent.
This sourceRequires audit records for privileged activity so consequential overrides can remain visible and reviewable.
- The discipline is separation of duties over who may waive, and logging every waiver as a first-class, reviewable event so overrides are visible rather than silent.
Verification¶
Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Read against the text for 4 of 24 citations: 4 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Links previously used in the corpus¶
Before the registry existed this work was also linked 1 other way.
Registry ID ref:c0729093eb29 · see in the full table