In the last lecture, we saw the definition of information security control.
Now let's have a look at the classification of security controls.
Security controls are classified into three types preventive controls, detective control and corrective
control, preventive control, that is a first class discourages or prevents the appearance of the problems.
And the detective control is the search for detect and identify the problems and corrective controls
are used to solve and prevent the reoccurrence of different issues.
Important note here is these different types of controls are interlinked.
For example, the implementation of an antivirus solution is a preventive control as it provides protection
against malware.
Right.
But at the same time, listen carefully.
At the same time, the antivirus is a detective measure.
When it detects a potential virus simultaneously, it provides a corrective measure when suspicious
file is quarantined or deleted.
So these controls are interrelated, but you have to make sure that you understand the major differences
between these preventive control.
It actually discourages or prevents the occurrence of problems that is detected, problems even before
they occur, control the operations or prevent error or omissions or malicious acts.
Examples can be separate development and testing, environment, restriction of access to systems publishing
and I assume its policy hiring only qualified personnel people and using cryptography or access control
software that only allows authorized personnel to access sensitive files.
The next type of security control is a detective control now detect the goal of distracted control is
to search for and identify the problems and incidents.
So examples can be integration of checkpoints in the applications, eco controlling telecommunications
alarms to detect smoke, heat, fire monitoring system, resources, alarm triggering, as I said,
detect break ins and video cameras.
Then technical review of applications after a modification of the operating system, the detection of
potential intrusion on networks with an idea system or user access.
Right now, the last security control is a corrective control.
Now the goal of corrective control is to overcome the problems that have already been discovered and
to prevent them from happening again.
So the main objective of corrective controls is to minimize the impact of a threat, overcome problems
discovered by the detection controls, identify the cause of the main problem, correct the errors arising
from problem, and modify the processing system to reduce the presence of future minimum problems.
Examples can include a review of the security policy after the integration of a new division to the
organization.
Appeal to the authorities to report a computer crime and change all the passwords of the systems implementation
of patches enabling busy control plan.
So these are examples of different security controls.
But when it comes to your understanding, make sure you understand the examples of preventive controls,
detective controls and corrective controls.
If some you have someone asks you during your interview about differentiation between these controls,
with the help of examples, you should be able to properly answer the question.
That is it, folks, in the next lecture, we will see the relationship between the different information
security aspects like threat, vulnerability and risks.
I hope you're enjoying this schools and I hope your fundamentals of information security are getting
clear if you're really enjoying this, cause I would just like you to please read our course because
your feedback is very valuable to us.
So I hope that you will read our course immediately after this lecture.
I will wait to see your personal feedback and all receiving your review.
I will personally.
Thank you.
So I will see you in the next lecture.