FAIR Controls: A New Kind of Controls Framework
summary
A new controls framework called FAIR-CAM models controls as interconnected loss event/variance/decision controls with granular functions—avoidance, deterrence, resistance; visibility/monitoring; resilience/loss reduction—so control value equals measured risk reduction and can be empirically validated. A partial ontology and mapping effort shows the CIS Top 20 (171 items) maps to CAM with 85% mapped cleanly and ~15% ambiguous, a white paper with full ontologies and measurement methods is due in October.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:16Ask yourself these questions....
- 1:41Why it matters...
- 3:51In the practice of medicine, which is more important?
- 4:25Human Anatomy vs. Physiology • Anatomical component: Spleen
- 6:12Cybersecurity Anatomy vs. Physiology
- 10:32FAIR-CAM Objectives
- 12:12Setting expectations...
- 14:39Clarifying terms
- 15:48Current controls "physiology"
- 17:57FAIR-CAM's Functional Domain Relationships
- 19:50Loss Event Controls (LEC) Ontology
- 20:57Loss Event Controls applied in context
- 22:46Variance Management Controls (VMC)
- 23:57Decision Support Controls (DSC)
- 25:24What's the value of this control?
- 27:27Control value diagram
- 28:57Summary
- 33:13Apply What You Have Learned Today
related talks
24mSecurity Compliance as Code
32mThe One About Controls
45mFrom Attacks to Action: An Open Community Model to Drive Defensive Choices
25mCrash Course on AI Risk Management Framework
15mAI Security Simplified: Turning Complexity into Cohesion
31mAI Interpretability as a Security Control: Introducing the CIRCUIT Framework
30mFireproof Your Castle with Risk-First GRC
15mRAIL: Risk-Aware Human-in-the-Loop Framework with Adaptive Intrusion Response...