Measures implemented to protect information systems and data from unauthorized access and vulnerabilities.
Description
Cybersecurity controls are protective measures employed to safeguard information systems and data, particularly in the context of Non-Human Identities (NHIs) such as bots, applications, and automated systems that interact with networks and data. NHIs often operate independently and can pose unique security challenges, including automated attacks or unauthorized access to sensitive information. Effective cybersecurity controls for NHIs involve a combination of technical, administrative, and physical safeguards designed to ensure the integrity, confidentiality, and availability of data. These controls can include identity and access management (IAM) solutions that enforce strict authentication protocols, encryption methods to protect data in transit and at rest, and continuous monitoring to detect and respond to anomalies. Additionally, organizations must implement policies and procedures that govern the behavior of NHIs, ensuring they operate within defined parameters to minimize risks. Overall, cybersecurity controls play a crucial role in maintaining the security posture of systems that utilize NHIs, preventing potential threats and enhancing overall cyber resilience.
Examples
- Identity and Access Management (IAM) systems for authenticating NHIs.
- Intrusion detection systems (IDS) to monitor NHIs for suspicious activity.
Additional Information
- Regular audits and assessments of NHIs to identify vulnerabilities.
- Training and awareness programs for staff on managing NHIs securely.
References
- Non-Human Identity Management | OASIS Security
- Non-human Account Management (v4)
- 2025 State of NHI and Secrets in Cybersecurity | Entro Labs
- Non-Persistence - CSF Tools
- NIST Special Publication (SP) 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171
- Human vs. Non-Human Identity in SaaS
- Personally Identifiable Information Quality Operations - CSF Tools
- NIST Special Publication (SP) 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
- CAPEC-195: Principal Spoof (Version 3.9)
- Redirecting to engage.mitre.org/