Which of the following is a detective control to address unauthorized network access?

P8.4. a. Preventive controls such as authentication so anyone trying accessing the system has to provide credentials and verify their identity, encryption so sensitive information cannot be accessed, and have a strong internal environment that educates employees on security measures. Detective controls such as log analysis could be used to show determine if someone is trying to log on to a system and is unsuccessful. Corrective controls such as having an effective CIRT that can access the laptop and block or delete important information so the theft cannot access the laptop. b. Preventive controls such as a password can be used, but to ensure it stays effective it should be long, include multiple characters, be changed frequently, and not easily be guessed. Other types of…show more content…
h. Preventive controls such as proper training and educating employees so they understand to never use a USB if they don’t know where it came from or what is on it. Antimalware or spyware software can be used for security protection. i. Preventive controls such as proper training and implementation of CIRT so that employees know where to go when an attack occurs. Corrective controls such as practicing the incident response plan and alert process can help when attacks occur and help identify gaps in the plan so they can be fixed for when a real attack happens. j. Preventive controls such as testing the systems and securing access by requiring proper verification of the users attempting to obtain dial-in access. Remote authentication dial-in user service is one way of verifying users for this. k. Preventive controls such as securing wireless access by encrypting wireless traffic and authenticating all devices that try to access the network before allowing them use to the IP address. Detective controls such as an IDS could be used to analyze for signs of attempted or successful

• F5 Labs
• Learning Center

An overview of the types of countermeasures security practitioners use to reduce risk.

August 22, 2019

3 min. read

Introduction

F5 Labs education articles help you understand basic threat-related security topics. 

At the most fundamental level, IT security is about protecting things that are of value to an organization. That generally includes people, property, and data—in other words, the organization’s assets.

Security controls exist to reduce or mitigate the risk to those assets. They include any type of policy, procedure, technique, method, solution, plan, action, or device designed to help accomplish that goal. Recognizable examples include firewalls, surveillance systems, and antivirus software.

Control Objectives First…

Security controls are not chosen or implemented arbitrarily. They typically flow out of an organization’s risk management process, which begins with defining the overall IT security strategy, then goals. This is followed by defining specific control objectives—statements about how the organization plans to effectively manage risk. For example, “Our controls provide reasonable assurance that physical and logical access to databases and data records is restricted to authorized users” is a control objective. “Our controls provide reasonable assurance that critical systems and infrastructure are available and fully functional as scheduled” is another example.

…Then Security Controls

Once an organization defines control objectives, it can assess the risk to individual assets and then choose the most appropriate security controls to put in place. One of the easiest and most straightforward models for classifying controls is by type: physical, technical, or administrative, and by function: preventative, detective, and corrective.

Control Types

Physical controls describe anything tangible that’s used to prevent or detect unauthorized access to physical areas, systems, or assets. This includes things like fences, gates, guards, security badges and access cards, biometric access controls, security lighting, CCTVs, surveillance cameras, motion sensors, fire suppression, as well as environmental controls like HVAC and humidity controls.

Technical controls (also known as logical controls) include hardware or software mechanisms used to protect assets. Some common examples are authentication solutions, firewalls, antivirus software, intrusion detection systems (IDSs), intrusion protection systems (IPSs), constrained interfaces, as well as access control lists (ACLs) and encryption measures.

Administrative controls refer to policies, procedures, or guidelines that define personnel or business practices in accordance with the organization's security goals. These can apply to employee hiring and termination, equipment and Internet usage, physical access to facilities, separation of duties, data classification, and auditing. Security awareness training for employees also falls under the umbrella of administrative controls.

Control Functions

Preventative controls describe any security measure that’s designed to stop unwanted or unauthorized activity from occurring. Examples include physical controls such as fences, locks, and alarm systems; technical controls such as antivirus software, firewalls, and IPSs; and administrative controls like separation of duties, data classification, and auditing.

Detective controls describe any security measure taken or solution that’s implemented to detect and alert to unwanted or unauthorized activity in progress or after it has occurred. Physical examples include alarms or notifications from physical sensor (door alarms, fire alarms) that alert guards, police, or system administrators. Honeypots and IDSs are examples of technical detective controls.

Corrective controls include any measures taken to repair damage or restore resources and capabilities to their prior state following an unauthorized or unwanted activity. Examples of technical corrective controls include patching a system, quarantining a virus, terminating a process, or rebooting a system. Putting an incident response plan into action is an example of an administrative corrective control.

The table below shows how just a few of the examples mentioned above would be classified by control type and control function.

F5 Labs Security Controls Guidance

To provide threat intelligence that’s actionable, F5 Labs threat-related content, where applicable, concludes with recommended security controls as shown in the following example. These are written in the form of action statements and are labeled with control type and control function icons. They’re meant to be a quick, at-a-glance reference for mitigation strategies discussed in more detail in each article.

Security practitioners implement a combination of security controls based on stated control objectives tailored to the organization’s needs and regulatory requirements. Ultimately, the goal of both control objectives and controls is to uphold the three foundational principles of security: confidentiality, integrity, and availability, also known as the CIA Triad.

Debbie Walkowski (Author)