3 Security Controls and Defense in Depth Free Online FlashCards

What is a security control?

A safeguard—such as a policy, procedure, device, or technical mechanism—that reduces risk to information, systems, or operations.

What does the CIA triad stand for?

Confidentiality, integrity, and availability. Controls can limit disclosure, prevent unauthorized changes, and help keep services available.

What do administrative controls govern?

Administrative controls guide how people and organizations manage security; examples include policies, employee training, and incident-response plans.

What characterizes a technical control?

They use technology to protect systems and data, such as multifactor authentication, firewalls, encryption, and automated audit logs.

What do physical controls protect against?

They protect buildings, equipment, and people from physical access or hazards; examples include locks, visitor badges, and fire-suppression systems.

What is the purpose of a preventive control?

They aim to stop an unwanted event or reduce its likelihood. Least-privilege permissions and secure configuration standards are examples.

What is the purpose of a detective control?

They identify or alert on events that have happened or may be happening, as intrusion alerts and audit-log reviews do.

What is the purpose of a corrective control?

They limit harm, restore operations, or address a discovered weakness; examples include restoring clean backups and applying a security patch.

What is defense in depth?

It combines complementary controls across people, processes, technology, and physical environments so another layer may help if one fails.

Can a security control belong to more than one category?

A safeguard can fit multiple categories. Categories describe different aspects, and classification depends on the purpose and framework used.

What should inform risk-based control selection?

Assess threats, vulnerabilities, likelihood, and impact, then consider implementation cost, usability, operational impact, and applicable requirements.

What does it mean to tailor and document a control choice?

Fit controls to the system and its environment, and document responsibilities, exceptions, and any compensating controls.