Security Controls Flashcards
What are the purpose of security controls?
-To prevent security incidents
-To minimize the impact
-To limit the damage
What are the four types of security controls?
- Technical
- Operational
- Managerial
- Physical
What are technical controls? Examples?
Controls implemented using systems.
Ex: Firewalls, anti-virus, operating system controls
What are operational controls? Examples?
Controls that uses ‘people’ instead of systems.
Ex: Security guards, awareness programs at work to explain best practices of IT security, lunch & learns
What are managerial controls? Examples?
Admin controls that are associated w/ security design & implementation.
Ex: Security policies, day-to-day processes
What are physical controls? Examples?
Controls that limit physical access.
Ex: Shack, fences, locks, badge readers
What are the six control types?
- Preventive
- Corrective
- Detective
- Directive
- Deterrent
- Compensating
What are preventive control types? Examples?
Controls that blocks access to resource.
Ex: Firewall, guard shack checks, on boarding policy, door locks
What are deterrent controls?
Examples?
Controls that discourage intrusion, does not directly prevent access.
Ex: Splash screens, front reception desk, threats of demotion, posted warning signs
What are detective controls? Examples?
Controls that identify and log an intrusion attempt, may not prevent access.
Ex: System logs, property patrols, review login reports, motion detectors
What are corrective controls? Examples?
Controls that are applied after an event has been detected. Reverse impact.
Ex: Restore from backups, law enforcement to manage criminal activity, create policies for reporting security issues. Use fire extinguisher.
What are compensating controls? examples?
Using other means of control, temporary & insufficient.
Ex: Firewall instead of patching, simultaneous guard duties, generator used after an outage
What are directive controls? Examples?
Directs a subject towards security compliance.
Ex: Store all sensitive files in a protected folder, train users on security policy, create compliance policies, post a sign for ‘Authorized Personnel Only.
