⚙️ Technological security
Technological (technical) controls are security mechanisms built into technology that automatically implement security policies - authentication, encryption, segmentation, logging. Based on ISO/IEC 27002 Chapter 8 (34 controls), NIST SP 800-53 and CIS Controls v8. Examples are fictional, intended for teaching.
Legend: codes in brackets (e.g. 8.24) refers to the (technological) controls of Chapter 8 of ISO/IEC 27002:2022.
What are technical controls
Classification of controls - type and function
Technical = logical controls: they are technology-based mechanisms that implement policies automatically and consistently (as opposed to administrative ones that rely on human action). This guide covers the technical controls of Chapter 8 of ISO/IEC 27002.
Functions
Preventive (prevented), detective (discovered), corrective (rejuvenating). In addition: dissuasive (abstains from attempted) and compensatory (alternative when basic control is not possible).
Defense in purity
Technical controls are placed in several layers - network, host, use, data, identity - so that one violation does not detect everything. See 'Defence depth' tab.
Relationship to the NIS2
The risk management measures of Article 21 of the NIS2 (EU 2022/2555) are largely technical controls: cryptography, access control, MFA, incident detection and business continuity.
Defense
Layers of technical controls - from network to data
Journaling and monitoring (8.15/8.16) cover all layers - they shall ensure that the infringement is noted. Identity is a cross-layer: each layer must be checked who accesss (Zero Trust - never trust by location).
Why Layers
No single control is infallible. Independent layers means that the attacker has to overcome several - network, host, use, data - before reaching the target.
The smallest privileges
Each layer is allocated only as necessary (lat pribilige, need-to-know). This limits how far an attacker can spread after a single layer of violation.
Accepts the infringement
The modern approach (size break) assumes that the perimeter will be violated. Therefore, important segmentation, monitoring and data encryption - so that the infringement is not detected all at once.
International practice
ISO/IEC 27002:2022 Chapter 8 - 34 technological controls
NIST SP 800-53 flocks
Technical controls are mainly: AC (access control), IA (identity and authentication), SC (protection of systems and communications), SI (system and information integrity), AU (audit), CM (configuration), CP (continuousity).
CIS Controls v8
Practical implementation list: CIS 3 (data protection), 4 (secure configuration), 5.
NIS2 and MK 397
NIS2 Article 21 and Latvian Cabinet Regulation No. 397 require technical measures - cryptography, MFA, access control, vulnerability management, logging and backup - proportionate to the risk.
Compliance in Latvia - main requirement MK 397: Cabinet Regulations No.397 is the binding regulation in Latvia, which determines what must be done (in the national cybersecurity framework, implementing the NIS2). Implementing Regulation (EU) 2024/2690 and GDPR complement the requirements. International standards (ISO 27001/27002, COBIT, SABSA, TOGAF, NIST) provide a recognised auditable method for their implementation.
MK 397 determines the result required by law. The international standard is a verifiable way to achieve it - without it compliance remains declarative.
MK 397 - National requirement
The binding regulation in Latvia establishes mandatory technical measures. The implementation is based on ISO 27002 Chapter 8, NIST SP 800-53 and CIS Controls v8 - they give a specific, measurable configuration that MK 397 requires as a result.
Implementing Regulation (EU) 2024/2690
The Annex details the technological requirements: cryptography, access control, secure system purchase/development/maintenance and asset management - direct ISO 27002 Chapter 8 controls.
Article 32 COD
GDPR requires 'appropriate technical measures' for the security of personal data - encryption, pseudonymisation, confidentiality, integrity and robustness. Technological controls (8.24, 8.11) are direct implementation.
SAM - ISO 8.2 / 8.3 / 8.5
Identity and access - authentication, authorisation, record keeping
Zero Trust: never trust for network location - each request is authenticated and rewritten (NIST SP 800-207). MFA against stolen passwords. The least privilege to the excess of rights.
Safe authentication (8.5)
Multifactor authentication (MFA), preferably phishing-resistant (FIDO2/WebAuthn, passkey). Passwords - long, checked against leaks, stored as Argon2/bcrypt mixing amounts.
Advanced access (8.2 / CVT)
Administrative rights separately: just-in-time allocation, session recording, separate admin accounts, vault secrets. Excessive privileges are the main route of spreading.
Access limitation (8.3)
Need-to-know and let privatege: the user sees only what he needs. Roles (RBAC) or attributes (ABAC), regular access review and immediate withdrawal when changing roles.
ISO 8.24 / 8.11 / 8.12
Cryptography and data protection - three data states
Cryptography (8.24) protects confidentiality and integrity, but is as strong as key management. Used tested algorithms and protocols (AES, TLS 1.3), not invented.
Data leakage prevention (8.12 / DLP)
DLP detects and blocks the output of sensitive data (email, USB, cloud). Combined with classification and labelling to know what to protect.
Masquerade and deletion (8.11 / 8.10)
Data masking and tokenisation reduces exposure in non-production environments. The Safe Deletion Policy shall ensure that data are permanently removed when no longer required.
Duplication and durability (8.13 / 8.14)
Duplicates on the 3--2-1 principle (3 copies, 2 carriers, 1 off-site), encrypted and tested with renewal tests. Redundance critical systems shall be made available.
ISO 8.7 / 8.8 / 8.9 / 8.16
Hardening, vulnerability management and monitoring
Monitoring (8.15 / 8.16): centralized logging → SIEM → correlation → warning → response. Without monitoring, other controls work blindly. Synchronize time (NTP, 8.17), otherwise events cannot be correctly correlated.
Configuration management (8.9)
Safe base configuration (hardening by CIS Benchmark), version control, deviation detection and change management. Default settings are rarely safe.
Protection against malware (8.7)
EDR/AV, application authorisation lists, email and web filtering, macro restrictions. In combination with user training and backups against ejectors.
Journaling and SIEM (8.15 / 8.16)
Windows are collected centrally and outside the host to be tested, kept append-only and long enough (NIS2 - at least 12 months). For more details, see the guide'Jurnalfail (windows) analysis'.