Security is like dentistry. You go to the dentist twice a year for reviews and advanced questions, but you don’t go to the dentist to brush your teeth. The security team should function like the dentist: regular checkups and expert issues.
—Robert Garigue, IT Security thought leader, former CISO of Bell Canada & Bank of Montreal
Controls are what you use to reduce risk. Controls can reduce likelihood or impact, and if you’re lucky, they can reduce both. The selection and arrangement of controls is an important step in the IT security program. This chapter explains how to design controls. ...
