control

Governance and Risk

Any deliberate measure put in place to reduce risk: a lock, a password rule, a nightly backup, a background check. Controls are what turn inherent risk into residual risk.

Related terms

preventive control

detective control

corrective control

residual risk

Appears in(155)

What PowerShell Is and Why It MattersPowerShell
Variables and TypesPowerShell
TCP, UDP, and PortsNetworking Foundations
Loops and RepetitionProgramming Foundations
Arrays, Ranges, and HashtablesPowerShell
Functions and ScriptsPowerShell
Automating a Real TaskPowerShell
Filesystem and PermissionsLinux for Security
Your First Python ProgramIntro to Python
How the Web WorksWeb Development
Processes and ServicesLinux for Security
GeoJSON: The Web-Native Spatial FormatSpatial Data and Formats
CSS: The StyleWeb Development
Networking from the CLILinux for Security
IPv6 and the Modern InternetNetworking Deep Dive
Network Automation and Infrastructure as CodeNetworking Deep Dive
Errors and How to Handle ThemPython Deep Dive
Build a Small ProgramIntro to Python
What a Backend IsBackends and APIs
How Language Models WorkBuilding with AI
What Version Control IsVersion Control with Git
Your First RepositoryVersion Control with Git
Building on the APIBuilding with AI
Connecting the API to a DatabaseBackends and APIs
Authentication and API SecurityBackends and APIs
Undoing MistakesVersion Control with Git
Density, Interpolation, and Zonal StatisticsSpatial Analysis
What a Database IsSQL and Databases
Components and SchematicsElectronics Foundations
Your First CircuitElectronics Foundations
Microcontrollers and ArduinoElectronics Foundations
Scripting a Real GIS Pipeline End to EndGIS Programming with Python
How Web Apps WorkWeb and HTTP
Cookies, Sessions, and AuthWeb and HTTP
Intercepting ProxiesWeb and HTTP
Edge Cases and Thinking Like a TesterDebugging and Testing
The OWASP Top 10Web and HTTP
Passwords and AuthenticationDigital Self-Defense
An Interactive Map with LeafletWeb Mapping
Spotting Scams and PhishingDigital Self-Defense
Modern Vector Tiles with MapLibre GLWeb Mapping
IDOR and SSRFVulnerabilities and Exploitation
Securing Your Devices and MessagesDigital Self-Defense
Symmetric vs AsymmetricCryptography
PKI and CertificatesCryptography
TLS in PracticeCryptography
Active Directory FundamentalsActive Directory
Enumerating Active DirectoryActive Directory
Common AD AttacksActive Directory
The Human Attack SurfaceSocial Engineering
Defending PeopleSocial Engineering
Windows Architecture and ProcessesWindows Fundamentals
The Windows RegistryWindows Fundamentals
Windows Permissions and PrivilegesWindows Fundamentals
PowerShell for SecurityWindows Fundamentals
Windows Networking and SMBWindows Fundamentals
Sockets and NetworkingPython for Security
Build a Port ScannerPython for Security
What Containers Actually AreDocker and Containers
Docker ComposeDocker and Containers
Running Vulnerable Apps in DockerDocker and Containers
Container Security BasicsDocker and Containers
Cross-Site ScriptingWeb Application Attacks
Command InjectionWeb Application Attacks
File Upload AttacksWeb Application Attacks
Server-Side Request ForgeryWeb Application Attacks
Insecure DeserializationWeb Application Attacks
Attacking AuthenticationWeb Application Attacks
Access Control and IDORWeb Application Attacks
A Real Testing WorkflowBurp Suite
A Repeatable Privesc MethodLinux Privilege Escalation
Kernel Exploits and CapabilitiesLinux Privilege Escalation
Token ImpersonationWindows Privilege Escalation
Dangerous Privileges and InstallersWindows Privilege Escalation
How Wi-Fi WorksWireless Security
Evil Twin and Rogue APsWireless Security
Google DorkingOpen Source Intelligence
Memory ForensicsDigital Forensics
Network ForensicsDigital Forensics
The Incident Response LifecycleIncident Response
Writing the Incident ReportIncident Response
Log Sources That MatterSIEM and Log Analysis
Hunting in LogsThreat Hunting
Documenting a HuntThreat Hunting
Analyzing Malware SafelyMalware Analysis
Static Analysis BasicsMalware Analysis
Network SegmentationNetwork Defense
VPNs and Zero TrustNetwork Defense
Detecting Lateral MovementNetwork Defense
Cloud Models and Shared ResponsibilityCloud Security Fundamentals
Common Cloud MisconfigurationsCloud Security Fundamentals
Storage ExposureCloud Security Fundamentals
AWS IAM in DepthAWS Security
Detection in AWSAWS Security
Pods, Services, and RBACKubernetes Security
Common Cluster MisconfigurationsKubernetes Security
Attacking a ClusterKubernetes Security
How Modern APIs WorkAPI Security
Broken Object Level AuthorizationAPI Security
Testing an APIAPI Security
Stack Buffer OverflowsIntroduction to Binary Exploitation
Controlling ExecutionIntroduction to Binary Exploitation
Reverse Engineering FundamentalsReverse Engineering
Patching BinariesReverse Engineering
Anti-Analysis TricksReverse Engineering
What GRC Actually IsGovernance, Risk, and Compliance
Risk ManagementGovernance, Risk, and Compliance
Security FrameworksGovernance, Risk, and Compliance
Audits and ComplianceGovernance, Risk, and Compliance
Policies People Actually FollowGovernance, Risk, and Compliance
Putting CTI to WorkCyber Threat Intelligence
What Detection Engineering IsDetection Engineering
Testing and Tuning DetectionsDetection Engineering
The Detection LifecycleDetection Engineering
Why Code Becomes VulnerableSecure Coding
Dependencies and Supply ChainSecure Coding
The Mobile Threat ModelMobile Application Security
Common Mobile VulnerabilitiesMobile Application Security
Testing a Mobile AppMobile Application Security
The IoT Attack SurfaceIoT and OT Security
Defending Connected DevicesIoT and OT Security
Padding Oracle AttacksCryptographic Attacks
Why You Need a LabBuilding a Home Lab
Networking Your LabBuilding a Home Lab
Stocking It With TargetsBuilding a Home Lab
Snapshots and Safe HabitsBuilding a Home Lab
Data Flow DiagramsThreat Modeling
Threat Modeling a Real AppThreat Modeling
Turning Threats Into FixesThreat Modeling
The Executive SummaryWriting Security Reports
The Map of Security RolesBreaking Into Security
HTTP Request SmugglingAdvanced Web Attacks
Attacking GraphQLAdvanced Web Attacks
Remediation and SLAsVulnerability Management
Authentication vs AuthorizationIdentity and Access Management
SSO and FederationIdentity and Access Management
Privileged Access ManagementIdentity and Access Management
The Identity LifecycleIdentity and Access Management
The Pillars of Zero TrustZero Trust Architecture
MicrosegmentationZero Trust Architecture
Identity as the PerimeterZero Trust Architecture
Rolling Out Zero TrustZero Trust Architecture
Why Email Is a TargetEmail Security
Phishing Defense in DepthEmail Security
DNS AttacksDNS and Network Services Security
Securing DNSDNS and Network Services Security
DHCP and NTP RisksDNS and Network Services Security
Signing and ProvenanceSoftware Supply Chain Security
Classifying DataData Protection and Privacy
Encryption at Rest and in TransitData Protection and Privacy
Key ManagementData Protection and Privacy
Data Loss PreventionData Protection and Privacy
From Design to PartMechanical Foundations
When Classical Physics BreaksQuantum Foundations
Quantum Computers in PracticeQuantum Foundations