Within the scope of control types exists control functions.
These different control functions help us to eliminate how
to respond to different actions within our system.
They're detective responsive, corrective and preventive
within preventive controls.
These are really controls that we identify to prevent
an action from occurring in the first place.
This is often the best route we want to go where
we don't really want the incident to occur at all.
So we provide preventive controls.
Preventive controls are controls that we utilize to prevent
an action from occurring in the first place.
This stops an incident from occurring so that we don't have to deal with it at all.
And it's the best option when it comes to cybersecurity,
we have different prevention controls that we can utilize.
For instance, access control lists.
These are usually involved within firewall sets
where we have blocklists or blacklisting.
We also have a allow list or white listing.
Those different aspects of an access control list can
prevent different types of communication within our enterprise environment.
We could also use antivirus software to stop viruses from injecting
themselves into our system through detection and then remediation efforts.
Right afterwards, we want to use secure configurations.
So we want to get rid of telnet,
maybe get rid of FTP or there's more unsecured ports from operating at all.
This would be secure configurations.
We also want to ensure that we're not using default username and passwords.
So unlike some telecommunication companies in the
recent future or the recent past,
from allowing anybody to do this log on to their system,
we make sure so that they don't have
that readily accessible entryway into our enterprise environment,
security policies and patch management also allow us to
ensure that employees aren't doing things that they shouldn't
be and that we're patching to the latest and
greatest secure version of the software that we're utilizing,
thereby preventing vulnerabilities,
flaws and misconfigurations within our systems.
All of this is designed to prevent unauthorized
access or prevent an incident from occurring.
Detective controls are often utilized after an incident has already occurred.
We utilize audit logs or surveillance cameras to capture things that have happened
in the past that allow people to gain access into our systems.
This is done after the fact, don't confuse a detective control as being a
manner in which case, we're trying to detect things as it's ongoing.
That's not the process of detective control.
Detective control is utilized after the incident is heard
or after the precursor to an incident has occurred.
Uh This is where students often get the two mixed up,
but it's done after the fact audit logs, surveillance cameras,
motion sensors or physical intrusion detection devices are
used after an incident has already occurred.
And we want to find out how the incident took place. What uh door did they go through?
What action did they take was a specific vulnerability they exploited,
maybe a specific port.
These are all detective controls to find out when the incident occurs.
How do they utilize technology or practices to
get into our system for unauthorized access?
A responsive control is in direct relation to an incident having occurring
and it's a permanent fix to that response or to that incident.
I should say
so.
For instance, if I've got a door that doesn't lock necessarily on the first time,
I may provide a responsive control to replacing the lock or
installing a lock that automatically locks the door upon it closing.
I may provide a spring or a mechanical function to that
door, automatically close it and lock it to where you have to badge into the system.
After the fact.
Remember,
responsive control is a control that we utilize to provide a
permanent fix or to fix a vulnerability within the system.
We're doing system restoration to bring that system back
to its original working state as a responsive control.
Maybe I have a business continuity plan or a
disaster recovery plan in action to provide corrective action.
If a vulnerability is exploited,
I may utilize such things as an antivirus program or
an intrusion prevention system to correct the fact that an incident
has occurred and provide updates to those systems to make sure
that if that virus or if that incident occurs again,
to identify it and quickly remediate
it uh in point of context to the actual uh event occurring for the first time.
A corrective control is a immediate knee jerk reaction
to the incident occurring.
This is usually a temporary fix or just some shutdown or some type of
temporary policy that we utilize to fix the issue in its in its entirety.
But it's not designed as a permanent fix.
For instance, when I was with a different company,
we had an issue where people were leaving
their trucks unlocked and equipment was getting stolen.
And so it's
policy is that you had to drop your truck back off at a
yard and then take your personal vehicle back home on a nightly basis.
They utilize this corrective control or this temporary
policy to get it across their employees to
stop leaving your trucks unlocked as kind of a uh uh hand slapped policy to say,
hey, we don't
have to allow you to take your trucks home every night.
And if you continue to be stupid and not lock your
trucks at night to allow people to take advantage of that,
we're going to make you drop your trucks off at the yard every
single night and which makes it more difficult for you as the employee.
That's a knee jerk reaction to fix a problem.
A temporary data backup may be more
facilitated for a technology control where we've
got an issue and we're starting to see signs of an incident occurring.
And as a very quick temporary solution, we're going to back up all those data files uh
temporarily on a device so that if the incident
does occur and wipe all of our drive drives,
we have immediate access to up to date backup information.
This could be temporary network restrictions.
It could be a temporary shutdown where we're shutting down systems
with an incident is occurring and trying to attack those systems.
It's just an immediate response that is temporary in nature to
provide a corrective control to stop something from happening very,
very quickly.