1.0 General Security Concepts

Question 1

What are Security Controls?

Answer 1

They protect assets such as data, physical property, and computer systems. They prevent security events, minimize the impact, and limit the damage

Question 2

What are Technical Controls?

Answer 2

• Controls implemented using systems
• Operating system controls
• Firewalls, anti-virus

Question 3

What are Managerial Controls?

Answer 3

– Administrative controls associated with security design and implementation
– Security policies, standard operating procedures

Question 4

What are Operational Controls?

Answer 4

– Controls implemented by people instead of systems
– Security guards, awareness programs

Question 5

What are Physical Controls?

Answer 5

– Limit physical access
– Guard shack
– Fences, locks
– Badge readers

Question 6

What are preventative controls types?

Answer 6

• Preventive
  – Block access to a resource
  – You shall not pass
• Prevent access
  – Firewall rules
  – Follow security policy
  – Guard shack checks all identification
  – Enable door locks

Question 7

What are deterrent control types?

Answer 7

*Deterrent
– Discourage an intrusion attempt
– Does not directly prevent access
* Make an attacker think twice
– Application splash screens
– Threat of demotion
– Front reception desk
– Posted warning signs

Question 8

What are detective control types?

Answer 8

• Detective
  – Identify and log an intrusion attempt
  – May not prevent access
• Find the issue
  – Collect and review system logs
  – Review login reports
  – Regularly patrol the proper

Question 9

What are Corrective control types?

Answer 9

• Corrective
  – Apply a control after an event has been detected
  – Reverse the impact of an event
  – Continue operating with minimal downtime
• Correct the problem
  – Restoring from backups can mitigate a ransomware
  infection
  – Create policies for reporting security issues
  – Contact law enforcement to manage criminal activity
  – Use a fire extinguisher

Question 10

What are compensating control types?

Answer 10

• Compensating
  – Control using other means
  – Existing controls aren’t sufficient
  – May be temporary
• Prevent the exploitation of a weakness
  – Firewall blocks a specific application instead of
  patching the app
  – Implement a separation of duties
  – Require simultaneous guard duties
  – Generator used after power outage

Question 11

What are directive control types?

Answer 11

• Directive
  – Direct a subject towards security compliance
  – A relatively weak security control
• Do this, please
  – Store all sensitive files in a protected folder
  – Create compliance policies and procedures
  – Train users on proper security policy
  – Post a sign for “Authorized Personnel Only”