• Technical controls use software and hardware resources to control access to
information and computing systems, to help mitigate the potential for errors and
blatant security policy violations. Examples of technical controls include passwords,
network- and host-based firewalls, network intrusion detection systems, and access
control lists and data encryption. Associated with technical controls is the Principle
of Least Privilege, which requires that an individual, program, or system process is
not granted any more access privileges than are necessary to perform the task.
• Physical controls monitor and protect the physical environment of the workplace and
computing facilities. They also monitor and control access to and from such
facilities. Separating the network and workplace into functional areas are also
physical controls. An important physical control is also separation of duties, which
ensures that an individual cannot complete a critical task by herself.