How this works
- Every control has a category, which is what it is, and one or more types, which is what it does. Answer both for each control.
- A control has exactly one category. It can have more than one type, and three of these twenty do.
- Select Check this control to see the reasoning straight away. Clear and retry as often as you like.
This activity uses the naming from Section 1.5 of the chapter: category is what the control is, type is what it does. Nothing here is graded and nothing is recorded.
Security Control Review
Category: what the control is
- Technical also called Logical
- Implemented in hardware, software or firmware. The system enforces it, not a person.
- Managerial also called Administrative
- A decision, policy or process put in place by management. People follow it because the organization requires it.
- Physical also called Environmental
- Something you can touch, or a condition of the building. It acts on the physical world.
- Operational
- Carried out by people as part of day-to-day work, rather than enforced by a system or written as policy.
Type: what the control does
- Preventive
- Stops the event from happening at all.
- Detective
- Identifies that the event happened, or is happening now.
- Corrective
- Restores things after the event, once it has already occurred.
- Deterrent
- Discourages someone from attempting it in the first place. It works on intent, not capability.
- Compensating
- Stands in for a primary control that cannot be used here. It is defined by why it exists, not by what it does.
- Mitigating
- Reduces how bad the event is when it happens, without making it less likely.
- Directive
- Instructs or requires people to behave a certain way.
The controls
Work in any order. Ask what the control physically is before you ask what it achieves, because the two answers are unrelated.
-
1 Control 1 of 20
Separation of duties requiring two approvers for any payment
-
2 Control 2 of 20
Network segmentation that limits how far an intruder can move
-
3 Control 3 of 20
A security guard patrolling the data center overnight
-
4 Control 4 of 20
Antivirus that flags a malicious file and moves it to quarantine
-
5 Control 5 of 20
Extra logging and daily log review on a legacy system that cannot be patched
-
6 Control 6 of 20
A fire suppression system in the server room
-
7 Control 7 of 20
An intrusion detection system that alerts on suspicious traffic
-
8 Control 8 of 20
A quarterly access review that finds accounts nobody needs any more
-
9 Control 9 of 20
An access vestibule at the data center door
-
10 Control 10 of 20
Encrypting the database column that holds card numbers
-
11 Control 11 of 20
Annual security awareness training for all staff
-
12 Control 12 of 20
Bollards outside the lobby entrance
-
13 Control 13 of 20
Tamper-evident seals on server rack doors
-
14 Control 14 of 20
A runbook the on-call engineer follows during an outage
-
15 Control 15 of 20
An acceptable use policy that every employee signs
-
16 Control 16 of 20
Restoring a server from last night's backup after a failure
-
17 Control 17 of 20
A firewall rule blocking inbound traffic on unused ports
-
18 Control 18 of 20
A documented and tested incident response plan
-
19 Control 19 of 20
A sign at the gate stating the premises are under video surveillance
-
20 Control 20 of 20
A background check before a candidate is hired