Security Controls

Question 1

Security control

Answer 1

A technology or procedure put in place to mitigate vulnerabilities and risk and to ensure the confidentiality, integrity, and availability (CIA) of information.

Question 2

Managerial

Answer 2

A category of security control that provides oversight of information systems.
This can be Management-based techniques, policies and procedures, D.R.P.

Question 3

Operational

Answer 3

A category of security control that is implemented by people.
This can be monitor function checks, Cameras, rounds, and visitor controls

Question 4

Technical

Answer 4

A category of security control that is implemented as a system.
software and network appliances ( IDS/IPS, Access controls apps, ASAs

Question 5

Physical

Answer 5

A category of security control that is implemented by hardware used to deter or detect, such as as alarms, gateways, locks, lighting, and security cameras.

Question 6

Preventive

Answer 6

A type of security control that acts before an incident to eliminate or reduce the likelihood that an attack can succeed.

Question 7

Access control lists (ACLs)

Answer 7

The collection of access control entries (ACEs) that determines which subjects (user accounts, host IP addresses, and so on) are allowed or denied access to the object and the privileges given (read-only, read/write, and so on).

Question 8

Detective

Answer 8

A type of security control that acts during an incident to identify or record that it is happening.
Network monitor applications, logs, alerts and events, IDS

Question 9

Corrective

Answer 9

A type of security control that acts after an incident to eliminate or minimize its impact.
fix events damage and works during and after. IPS and endpoint detection.

Question 10

Directive

Answer 10

A type of control that enforces a rule of behavior through a policy or contract.

Question 11

Deterrent

Answer 11

A type of security control that discourages intrusion attempts.

Question 12

Compensating

Answer 12

A security measure that takes on risk mitigation when a primary control fails or cannot completely meet expectations.

Question 13

Chief Information Officer (CIO)

Answer 13

A company officer with the primary responsibility of managing information technology assets and procedures.

Question 14

Chief Technology Officer (CTO)

Answer 14

A company officer with the primary role of making effective use of new and emerging computing platforms and innovations.

Question 15

Chief Security Officer (CSO)

Answer 15

Typically, the job title of the person with overall responsibility for information assurance and systems security.

Question 16

Information Systems Security Officer (ISSO)

Answer 16

Organizational role with technical responsibilities for implementation of security policies, frameworks, and controls.