GCGA Ch. 1 Understanding Security Controls

Question 1

Four security control categories

Answer 1

managerial, operational, technical, and physical.

Question 2

Managerial controls

Answer 2

primarily administrative and include items such as risk and vulnerability assessments.

Question 3

Operational controls

Answer 3

focused on the day-to-day operations of an organization. They help ensure an organization is complying with its overall security plan. Some examples include security awareness and training, configuration management, and change management.

Question 4

Technical controls

Answer 4

use technology to reduce vulnerabilities. Encryption, antivirus software, IDSs, firewalls, and the principle of least privilege are technical controls.

Question 5

Physical controls

Answer 5

any controls that you can physically touch. Some examples are bollards and other barricades, access control vestibules (sometimes called mantraps), lighting, fences, and signs.

Question 6

Six control types

Answer 6

preventive, deterrent, detective, corrective, compensating, and directive.

Question 7

Preventive controls

Answer 7

attempt to prevent security incidents. Examples include system hardening, user training, guards, change management, and account disablement processes.

Question 8

Detective controls

Answer 8

attempt to detect when a vulnerability has been exploited. Examples include log monitoring, security information and event management (SIEM) systems, trend analysis, video surveillance systems, and motion detection systems.

Question 9

Deterrent controls

Answer 9

attempt to prevent incidents by discouraging threats. Examples include locks and guards. Note that these can also be described as preventive controls. The primary difference is that they try to discourage people from trying to exploit a weakness.

Question 10

Corrective controls

Answer 10

attempt to reverse the impact of an incident or problem after it has occurred. Examples include backups, system recovery plans, and incident handling processes.

Question 11

Compensating controls

Answer 11

alternative controls used when it isn’t feasible or possible to use the primary control.