Within the scope of control types exist.
Control functions.
These different control functions help us to eliminate how to respond to different actions within our
system.
They're detective, responsive, corrective and preventive.
Within preventive controls, these are really controls that we identify to prevent an action from occurring
in the first place.
This is often the best route we want to go where we don't really want the incident to occur at all.
So we provide preventive controls.
Preventive controls are controls that we utilize to prevent an action from occurring in the first place.
This stops an incident from occurring so that we don't have to deal with it at all.
And it's the best option.
When it comes to cybersecurity, we have different preventive controls that we can utilize.
For instance access control lists.
These are usually involved within firewall sets where we have block lists or blacklisting.
We also have a loud list or whitelisting those different aspects of an access control list can prevent
different types of communication within our enterprise environment.
We could also use antivirus software to stop viruses from injecting themselves into our system through
detection and then remediation efforts.
Right afterwards, we want to use secure configurations.
So we want to get rid of telnet, maybe get rid of FTP or those more unsecure ports from operating at
all.
This would be secure configurations.
We also want to ensure that we're not using default username and passwords.
So unlike some telecommunication companies in the recent future or the recent past, from allowing anybody
to just log on to their system, we make sure that they don't have that readily accessible entryway
into our enterprise environment.
Security policies and patch management also allow us to ensure that employees aren't doing things that
they shouldn't be, and that we're patching to the latest and greatest secure version of the software
that we're utilizing, thereby preventing vulnerabilities, flaws, and misconfigurations within our
systems.
All of this is designed to prevent unauthorized access or prevent an incident from occurring.
Detective controls are often utilized after an incident has already occurred.
We utilized audit logs or surveillance cameras to capture things that have happened in the past that
allow people to gain access into our systems.
This is done after the fact.
Don't confuse a detective control as being a matter, in which case we're trying to detect things as
it's ongoing.
That's not the process of detective control.
Detective control is utilized after the incident has occurred, or after the precursor to an incident
has occurred.
This is where students often get the two mixed up, but it's done after the fact.
Audit logs, surveillance cameras, motion sensors, or physical intrusion detection devices are used
after an incident has already occurred, and we want to find out how the incident took place.
What, uh, door did they go through?
What action do they take?
Was there a specific vulnerability that they exploited?
Maybe a specific port?
These are all detective controls to find out when the incident occurs.
How did they utilize technology or practice is to get into our system for unauthorized access.
Our responsive control is in direct relation to an incident having occurring, and it's a permanent
fix to that response or to that incident, I should say.
So, for instance, if I've got a door that doesn't lock necessarily on the first time, I may provide
a responsive control to replacing the lock or installing a lock that automatically locks the door upon
it closing.
I may provide a spring or a mechanical function to that door to automatically close it and lock it to
where you have to badge into the system after the fact.
Remember, responsive control is a control that we utilize to provide a permanent fix or to fix a vulnerability
within the system.
We're doing system restoration to bring that system back to its original working state as a responsive
control.
Maybe I have a business continuity plan or a disaster recovery plan in action to provide corrective
actions.
If a vulnerability is exploited, I may utilize such things as an antivirus program or an intrusion
prevention system to correct the fact that an incident has occurred and provide updates to those systems
to make sure that if that virus or if that incident occurs again, to identify it and quickly remediate
it.
In point of context, to the actual event occurring for the first time, a corrective control is a immediate
knee jerk reaction to the incident occurring.
This is usually a temporary fix, or a system shutdown, or some type of temporary policy that we utilize
to fix the issue in its in its entirety, but it's not designed as a permanent fix.
For instance, when I was with a different company, we had an issue where people were leaving their
trucks unlocked and equipment was getting stolen.
And so a temporary policy is that you had to drop your truck, back off at a yard, and then take your
personal vehicle back home on a nightly basis.
They utilize this corrective control or this temporary policy to get it across to their employees,
to stop leaving your trucks unlocked as kind of a hand slapped policy to say, hey, we don't have to
allow you to take your trucks home every night.
And if you continue to be stupid and not lock your trucks at night to allow people to take advantage
of that, we're going to make you drop your trucks off at the yard every single night, which makes
it more difficult for you as the employee.
That's a knee jerk reaction.
To fix a problem, a temporary data backup may be more facilitated for a technology control where we've
got an issue and we're starting to see signs of an incident occurring.
And as a very quick temporary solution, we're going to back up all those data files temporarily on
a device so that if the incident does occur and wipe all of our drive drives, we have immediate access
to up to date backup information.
This could be temporary network restrictions.
It could be a temporary shut down where we're shutting down systems.
If an incident is occurring and trying to attack those systems, it's just an immediate response that
is temporary in nature to provide a corrective control, to stop something from happening very, very
quickly.