Section 16.155 Selecting Infrastructure Controls

Question 1

Control

Answer 1

A protective measure put in place to reduce potential risks and safeguard an organisations assets

Question 2

Key Principles

Least Privilege

Answer 2

Users and systems should have only necessary access rights to reduce the attack surface

Question 3

Key Principles

Defense in Depth

Answer 3

Utilise multiple layers of security to ensure robust protection even if onecontrol fails

Question 4

Key Principles

Risk-based Approach

Answer 4

Prioritise controls based on potential risks and vulnerabilities specific to the infrastructure

Question 5

Key Principles

Lifecycle Management

Answer 5

Regularly review, update, and retire controls to adapt to the evolving threat landscape

Question 6

Key Principles

Open Design Principle

Answer 6

Ensure transparency and accountability through rigorous testing and scrutiny of controls

Question 7

Methodology

Assess Current State

Answer 7

Understand existing infrastructure, vulnerabilities, and current controls

Question 8

Methodology

Gap Analysis

Answer 8

Identify discrepancies between current and desired security postures

Question 9

Methodology

Set Clear Objectives

Answer 9

Define specific goals for adding new controls (data protection, uptime, compliance, etc.)

Question 10

Benchmarking

Answer 10

Compare your organization’s processes and security metrics with industry best practices

Question 11

Methodology

Cost-Benefit Analysis

Answer 11

Evaluate the balance between desired security level and required resources

Question 12

Methodology

Stakeholder Involvement

Answer 12

Engage relevant stakeholders to ensure controls align with business
operations

Question 13

Methodology

Monitoring and Feedback Loops

Answer 13

Continuously revisit control selection to adapt to evolving threats

Question 14

Best Practices

Conduct Risk Assessment

Answer 14

Regularly assess threats and vulnerabilities specific to your organisation and update it with significant changes

Question 15

Best Practices

Align with Frameworks

Answer 15

Utilise established frameworks (e.g., NIST, ISO) to ensure comprehensive and tested methodologies

Question 16

Best Practices

Customise Frameworks

Answer 16

Tailor framework controls to your organizations unique risk profile and business operations

Question 17

Best Practices

Stakeholder Engagement and Training

Answer 17

Engage all relevant stakeholders in the decision-making process, and conduct regular training to keep the workforce updated on security controls and threats