What are security controls and provide examples in software?

• A. Security controls are decorative UI elements.
• B. Security controls are measures to reduce risk. Examples: authentication, authorization, encryption, input validation, logging, and secure communications.
• C. Security controls are only physical devices.
• D. Security controls replace the need for secure coding.

Answer: (B)

Security controls are the measures built into a software system to reduce risk by preventing, detecting, or responding to threats. In software, they include authentication to verify identity, authorization to enforce permissions, encryption to protect data at rest and in transit, input validation to block malformed or malicious data, logging to monitor activity and support incident response, and secure communications to ensure data integrity and confidentiality over networks. These controls work together to limit exposure so that even when a vulnerability exists, exploitation is harder and the potential impact is smaller. The other options don’t fit because decorative UI elements don’t address risk, physical devices alone aren’t the primary form of software controls, and relying on secure coding alone doesn’t replace the need for ongoing protective measures.