Cyberstudy
PDF p.19 In progress

Security Control Functional Types

Open PDF at p.19 17 flashcards

Summary

PDF p.19

Security controls can be defined by their function: preventive, detective, corrective, directive, deterrent, and compensating. Each type serves a specific role in protecting information systems and data assets.

In plain words

Supplementary — not from your PDF

Functional types describe what a control does and when. Preventive controls stop attacks before they happen, detective controls spot them while they happen, and corrective controls limit the damage afterwards. Directive controls tell people the rules. Deterrent controls discourage attackers. Compensating controls stand in when the normal control can't be used.

Detailed explanation

PDF p.19
  • Preventive Controls
    • Definition: Eliminate or reduce the likelihood of an attack succeeding.
    • Operation: Before an attack.
    • Examples
      • Access Control Lists (ACLs): Configured on firewalls and file systems.
      • Antimalware Software: Blocks malicious processes.
  • Detective Controls
    • Definition: Identify and record attempted or successful intrusions.
    • Operation: During an attack.
    • Examples
      • Logs: Record events and activities.
  • Corrective Controls
    • Definition: Eliminate or reduce the impact of a security policy violation.
    • Operation: After an attack.
    • Examples
      • Backup Systems: Restore damaged data.
      • Patch Management Systems: Fix vulnerabilities.
  • Directive Controls
    • Definition: Enforce rules of behavior, policies, and procedures.
    • Examples
      • Employee Contracts: Set disciplinary procedures.
      • Training Programs: Raise awareness and enforce policies.
  • Deterrent Controls
    • Definition: Psychologically discourage attackers.
    • Examples
      • Signs and Warnings: Legal penalties for trespass or intrusion.
  • Compensating Controls
    • Definition: Substitute for principal controls, providing equivalent or better protection.
    • Examples
      • Alternative Technologies: Different methods to achieve security.

Important terms

taken from the text above
Preventive Controls
Eliminate or reduce the likelihood of an attack succeeding.
Access Control Lists (ACLs)
Configured on firewalls and file systems.
Antimalware Software
Blocks malicious processes.
Detective Controls
Identify and record attempted or successful intrusions.
Logs
Record events and activities.
Corrective Controls
Eliminate or reduce the impact of a security policy violation.
Backup Systems
Restore damaged data.
Patch Management Systems
Fix vulnerabilities.
Directive Controls
Enforce rules of behavior, policies, and procedures.
Employee Contracts
Set disciplinary procedures.
Training Programs
Raise awareness and enforce policies.
Deterrent Controls
Psychologically discourage attackers.
Signs and Warnings
Legal penalties for trespass or intrusion.
Compensating Controls
Substitute for principal controls, providing equivalent or better protection.
Alternative Technologies
Different methods to achieve security.
ACLs Access Control Lists

Examples & real-world scenarios

Supplementary — not from your PDF
  • Preventive: an access control list that blocks a port.
  • Detective: reviewing logs.
  • Corrective: restoring data from backup, or applying a patch.
  • Directive: an acceptable use policy that employees sign.
  • Deterrent: a sign warning that intruders will be prosecuted.
  • Compensating: extra isolation and monitoring for a legacy system that can't be patched.

Scenario

A payment terminal can't run the required security software. The company puts it on an isolated network segment with strict firewall rules (a compensating control for the missing software) and reviews its logs daily (a detective control).

Common mistakes

Supplementary — not from your PDF
  • Confusing deterrent (discourages the attacker psychologically) with preventive (actually blocks the attack).
  • Calling a recording camera preventive. Recording is detective; a visible camera or warning sign can also deter.
  • Thinking a compensating control may be weaker. It must give equivalent or better protection.

Practical skills

Supplementary — not from your PDF
  • For any control, say when it acts (before, during or after an attack) and name its functional type.

What I should remember

Key Points PDF p.19
  • Preventive Controls
    • Purpose: Prevent attacks.
    • Examples: ACLs, antimalware software.
  • Detective Controls
    • Purpose: Detect and record intrusions.
    • Examples: Logs.
  • Corrective Controls
    • Purpose: Mitigate impact post-attack.
    • Examples: Backup systems, patch management.
  • Directive Controls
    • Purpose: Enforce behavior and policies.
    • Examples: Employee contracts, training programs.
  • Deterrent Controls
    • Purpose: Discourage attacks.
    • Examples: Legal warnings.
  • Compensating Controls
    • Purpose: Substitute for primary controls.
    • Examples: Alternative security technologies.