General Security Concepts: Examine Security Control Types Flashcards
What are the 7 Security Control Types
Preventive
Deterrent
Detective
Corrective
Compensating
Recovery
Directive
What is the function of a Preventive Security Control Type?
Preventative: Helps block or avoid a compromise of information systems.
What is the function of a Deterrent Security Control Type?
Deterrent: Seeks to discourage potential threats, making these assets look less appealing or more difficult to exploit.
What is the function of a Corrective Security Control Type?
Corrective: Provides mitigation and remediation for a security incident’s impact.
What is the function of a Compensating Security Control Type?
Compensating: Provides an alternative measure to meet a requirement of the implemented security control.
What is the function of a Recovery Security Control Type?
Recovery: Returns a system or normalcy following a security incident.
What is the function of a Directive Security Control Type?
Directive: Are mandatory controls that pertain to guidance and governing adherence to regulations and standards.
What are the example of a Preventive Security Control Type?
Preventative:
Data encryption: Blocks unauthorized users from organizational data.
Application filtering: Blocks applications from executing or permits them to. This is sometimes referred to as a white/black listing.
Access control systems: Allows or denies access to resources for authorized users while blocking all access to unauthorized users.
What are the example of a Deterrent Security Control Type?
Signs: Discourages unauthorized access to restricted locations or facilities, and includes labels and warnings.
Security cameras: Dissuade bad actors from committing malicious activities, as are visible and can be seen.
Guards: Discourages bad actors from performing malicious activities by providing the physical presence of trained security personnel who actively monitor locations.
What are the example of a Detective Security Control Type?
Detective:
CCTV: Provides recorded video that you can review so as to identify bad actors.
Motion sensors: Provides a triggered response mechanism that’s built into such devices as lights, cameras, and alarms.
IDS/IPS: Provides real-time monitoring and response mechanisms for security compromises.
Security Information and Event Management (SIEM) systems: Combines log analysis and correlation, and a centralized platform for detecting, collecting, managing, and analyzing security events.
What are the example of a Corrective Security Control Type?
Corrective:
Data backup and restore procedures: Enables organizations to provide crucial data protection and recovery.
Incident response plans and procedures: Provides an organization with the steps, tools, and guidance needed to address a potential security incident.
What are the example of a Compensating Security Control Type?
Compensating:
Network segmentation: An example is a security control that provides an alternative (compensating) method for patching legacy systems.
Virtualization: An example is a security control that isolates a legacy application or system when patching isn’t an obtainable security control.
What are the example of a Recovery Security Control Type?
Recovery:
Disaster recovery plan (DRP): Provides a strategy, guidelines, and procedures for restoring systems and data after a major disruptive event.
Data backup and restoration utilities: Creates copies of data and system configurations, which you can use to restore systems and data if data loss, corruption, or system failures occur.
Business continuity plan (BCP): Outlines strategies and actions to ensure essential business functions continue during and after disruptive events, including IT-related incidents.
What are the example of a Directive Security Control Type?
Directive:
Acceptable use policy (AUP): Outlines the appropriate and expected behavior that employees must adhere to when using an organization’s information system(s).
Password policy: Establishes and controls an organization’s user-password construction and usage requirements.
Data classification policy: Categorizes an organization’s data by sensitivity and outlines appropriate storage, , and sharing procedures.
