Control Objectives 2

Question 1

Directive controls

Answer 1

Are proactive actions taken to cause or encourage a desirable event and outcome occur. Are broad in nature, used to increase the effectiveness of other controls, examples: frameworks, models, polices, guidance statements

Question 2

Control category - operational

Answer 2

Operational controls are aligned with a process that are primaily implemented and executed by people (change management, testing, training)

Question 3

Control classification- corrective

Answer 3

Corrective controls minimize the impact of a threat agent or modify or fix situation

Question 4

Control category- technical

Answer 4

Technical control mechanism are implemented using hardware, software and/or firmware components, can be native or supplementary (firewalls, cryptography, 2FA)

Question 5

Control classification - preventive

Answer 5

Preventive controls stop a threat agent from being successful

Question 6

Layered security

Answer 6

Layered security (defense-in-depth) is the design and implementation of multiple overlapping layers of diverse controls

Question 7

Control category-Managerial

Answer 7

Managerial controls relate to risk management, governance, oversight, strategic alignment and decision making

Question 8

Control category physical

Answer 8

Physical controls are designed to address physical interactions. Generally related to buildings and equipment

Question 9

Control classification : Deterrent

Answer 9

Deterrent controls discourage a threat agent from acting

Question 10

Control classification : Detective controls

Answer 10

Detective controls identify and report a threat agent or a threat action

Question 11

Compensating controls

Answer 11

Compensating controls are implemented in lieu of a recommended control that provided equivalent or comparable protection, can be supplemental, short-term or temporarly

Question 12

Control type examples - preventive

Answer 12

Technical preventive => firewall (operating by system)
Managerial preventive => on-boarding policy (policies)
Operational preventive => guard shack (by person)
Physical preventive => door lock (made by equipment)
Blocks access to a resource, you shall not pass

Question 13

Control types examples - deterrent

Answer 13

Technical deterrent => splash screen (pop up screen for example requiring to put your credentials to gran access - software control)
Managerial deterrent => demotions (process of reducing for a lower grade)
Operational deterrent => reception desk (performing by people)
Physical deterrent => warning signs (building equipment)
This type of control does NOT encourage intrusion to go, this controls make you think twice before attack, does NOT directly prevent access.

Question 14

Control types examples - deterrent

Answer 14

Technical deterrent => splash screen (pop up screen for example requiring to put your credentials to gran access - software control)
Managerial deterrent => demotions (process of reducing for a lower grade)
Operational deterrent => reception desk (performing by people)
Physical deterrent => warning signs
This type of control does NOT encourage intrusion to go, this controls make you think twice before attack, does NOT directly prevent access.

Question 15

Control type examples - detective

Answer 15

Technical detective => system logs (performed by software)
Managerial detective => review login reports
Operational detective=> property patrols (made by people)
Physical detective => motion detectors (equipment)
Warning and log information about the attack.finding issue.

Question 16

Control types examples - corrective

Answer 16

Technical corrective => backup recovery (software)
Managerial corrective => policy for reporting issues
Operational corrective => contact authorities about the crime
Physical corrective => use distinguisher (equipment)
Apply a control after event detection to reverse an impact of event or continuing operating with minimal downtime,

Question 17

Control types examples - compensating control

Answer 17

Technical compensating => block software until patch is available (software)
Managerial compensating => separation of duties
Operational compensating => require new security staff patrols (people operating)
Physical compensating => power generator ( additional equipment)
When the current controls are not sufficient, temporarily implemented before fix plan implemented

Question 18

Control types examples- directive control

Answer 18

Technical directive => file storage policies (software data type labeling)
Managerial directive => compliance policies
Operational directive=> security policy training (operated by people)
Physical directive => sign: authorized personel only ( equipment)
Directing someone to do something more secure, weak security control. Do this please type of control.