Compare and contrast various types of controls

Question 1

Category

Answer 1

Managerial
Operational
Technical

Question 2

Managerial

Answer 2

Managerial—the control gives oversight of the information system. Examples could include risk identification or a tool allowing the evaluation and selection of other security controls.

Question 3

Operational

Answer 3

Operational—the control is implemented primarily by people rather than systems. For example, security guards and training programs are operational controls rather than technical controls.

Question 4

Technical

Answer 4

Technical—the control is implemented as a system (hardware, software, or firmware). For example, firewalls, antivirus software, and OS access control models are technical controls. Technical controls may also be described as logical controls.

Question 5

Control type

Answer 5

Preventative
Detective
Corrective
Deterrent
Compensating
Physical

Question 6

Preventative

Answer 6

Preventive—the control acts to eliminate or reduce the likelihood that an attack can succeed. A preventative control operates before an attack can take place. Access control lists (ACL) configured on firewalls and file system objects are preventative-type controls. Anti-malware software also acts as a preventative control, by blocking processes identified as malicious from executing. Directives and standard operating procedures (SOPs) can be thought of as administrative versions of preventative controls.

Question 7

Detective

Answer 7

Detective—the control may not prevent or deter access, but it will identify and record any attempted or successful intrusion. A detective control operates during the progress of an attack. Logs provide one of the best examples of detective-type controls.

Question 8

Corrective

Answer 8

Corrective—the control acts to eliminate or reduce the impact of an intrusion event. A corrective control is used after an attack. A good example is a backup system that can restore data that was damaged during an intrusion. Another example is a patch management system that acts to eliminate the vulnerability exploited during the attack.

Question 9

Deterrent

Answer 9

Deterrent—the control may not physically or logically prevent access, but psychologically discourages an attacker from attempting an intrusion. This could include signs and warnings of legal penalties against trespass or intrusion.

Question 10

Compensating

Answer 10

Compensating—the control serves as a substitute for a principal control, as recommended by a security standard, and affords the same (or better) level of protection but uses a different methodology or technology.

Question 11

Physical

Answer 11

Physical—controls such as alarms, gateways, locks, lighting, security cameras, and guards that deter and detect access to premises and hardware are often classed separately.