Security Controls Flashcards
Assets
Assets are varied. They can be data, physical property, and computer systems.
How to prevent security events, minimize impact, and limit damage?
Use security controls
What are the four control catagories
Techical, Managerial, Operational, and Physical
Technical Controls
- Controls implemented using systems
- Operating systems controls
- Firewalls, anti-virus
Managerial Controls
- Administrative controls associated with security design and implementation.
- Security policies, standard operating procedures
Operational Controls
- Controls implemented by people instead of systems
- Security guards, awareness programs
Physical Controls
- Limited physical access
- Guard shack
- Fences, locks
- Badge readers
Preventive Controls
Blocks access to a recource
Ways to prevent access?
- Firewalls rules
- Follw security policy
- Guard shack checks all identification
- Enable door locks
Deterrent Controls
Deterrent discorages an intrusion attempt. This does not directly prevent access
Was to discourage attackers?
- Use application splash screens
- Threat of demotion for employees
- Presence of a front desk receptionist
- Post warning signs
Detective Controls
Identify and log an intrusion attempt. This may not prevent access.
Finding the issue by doing the following:
- Collecting and reviewing system logs
- Reviewing login reports
- Regularly patrol the property
- Enable motion detectors
Corrective Controls
When applying a control after an event has been detected. This is to help reverse the impact of an event while continuing to operate with minimal downtime.
Correcting the problem is when you restore from backups when trying to mitigate a ransomeware attack.
Creating policies for reporting security issues.
Contacting law enforcement to manage criminal activity
Use a fire extinguisher
Compensating Control
Control using other means when existing controls are not enough. This may be temporary
How to prevent the exploitation of a weakness
- Using firewall blkocks for specific application instead of patching the app
- Inmplement a separation of duties
- requiring simulation guard duties
- Generator used if there is a power outage
Directive Controls
Direct a subject towards security compliance. This is considered a weak security control.
Examples:
1. Storing sensitive files in a protective folder
2. Creating compliance policies and procedures
3. Train users on proper security policy
4. Post a sign for “Authorized Personnel Only”
