Security Controls 1.1

Question 1

Technical Controls

Answer 1

• Uses some form of technology to address a physical security issue.

Question 2

Examples of Technical Controls

Answer 2

• Operating system controls
• Firewall, anti-virus

Question 3

Operational Controls

Answer 3

• Controls implemented by people instead of systems.
• Relies more on people to set the controls.

Question 4

Examples of Operational Controls

Answer 4

• Security guards
• Awareness programs

Question 5

Managerial Controls

Answer 5

• Administrative controls associated with security design and implementation.
• Security policies which include standard operating procedures.

Question 6

Examples of Managerial Controls

Answer 6

• Security policies
• Standard operating procedures

Question 7

Physical Controls

Answer 7

• Prevent specific human interaction with a system.

Question 8

Examples of Physical Controls

Answer 8

• Guard shack
• Fences, locks
• Badge readers

Question 9

Preventive Control Types - Preventive

Answer 9

• Limits someones to a resource.

Question 10

Preventive Control Types - Prevent Access

Answer 10

• Firewall rules.
• Follow security policy.
• Guard shack checks all identification.
• Enable door locks.

Question 11

Preventative - Technical

Answer 11

Firewall, blocks access to a specific resource.

Question 12

Preventative - Managerial

Answer 12

On-boarding policy

Question 13

Preventative - Operational

Answer 13

Guard shack

Question 14

Deterrent Control Types

Answer 14

• Discourage an intrusion attempt.
• Does not directly prevent access.

Question 15

Preventative - Phyiscal

Answer 15

Door lock, preventing access to the a room.

Question 16

Deterrent Control Types - Technical

Answer 16

Splash screen

Question 17

Deterrent Control Types - Managerial

Answer 17

Demotion

Question 18

Deterrent Control Types - Operational

Answer 18

Reception Desk, requires a person to operate.

Question 19

Deterrent Control Types - Physical

Answer 19

Warning signs

Question 20

Detective Control Types

Answer 20

• Identify and log an intrusion attempt.
• May not prevent access.

Question 21

Detective Control Types - Technical

Answer 21

System logs

Question 22

Detective Control Types - Operational

Answer 22

Property patrols

Question 23

Detective Controls Types - Managerial

Answer 23

Review login reports

Question 24

Detective Control Types - Physical

Answer 24

Motion detectors

Question 25

Corrective Control Types

Answer 25

- Apply a control after an event has been detected. - Reverse the impact of an event. - Continue operating with minimal downtime.

Question 26

Corrective Control Types - Technical

Answer 26

Backup recovery

Question 27

Corrective Control Types - Managerial

Answer 27

Policies for reporting issues

Question 28

Corrective Control Types - Operational

Answer 28

Contact authorities

Question 29

Corrective Control Types - Physical

Answer 29

Fire extinguisher

Question 30

Compensating Control Types

Answer 30

- Control using other means. - Existing controls aren't sufficient. - May be temporary.

Question 31

Purpose of Compensation Control Types

Answer 31

- Prevent the exploitation of a weakness

Question 32

Compensating Control Types - Technical

Answer 32

Block instead of patch

Question 33

Compensating Control Types - Managerial

Answer 33

Separation of duties

Question 34

Compensating Control Types - Operational

Answer 34

Require multiple security staff.

Question 35

Compensating Control Types - Physical

Answer 35

Power generator

Question 36

Directive Control Types

Answer 36

- Direct a subject towards security compliance. - A relatively weak security control.

Question 37

Directive Control Types - Technical

Answer 37

File storage policies

Question 38

Directive Control Types - Managerial

Answer 38

Compliance policies

Question 39

Directive Control Types - Operational

Answer 39

Security policy training

Question 40

Directive Control Types - Physical

Answer 40

Sign: Authorized personnel only.

Question 41

AIC Triad - Integrity

Answer 41

- Messages cannot be modified with detection availability.

Question 42

AIC - Availability

Answer 42

- Systems and networks must be up and running.