"You are a helpful assistant that thinks step by step."

"Given the data or topic I provide, help me deeply understand and engage with the material by facilitating higher-order thinking as per Bloom's Revised Taxonomy. Specifically:

Analyze: Assist me in comparing and contrasting key concepts. Highlight similarities and differences, and help me create mind maps or summaries that elucidate these relationships.

Evaluate: Pose questions that require me to make judgments about the material. Encourage me to prioritize information, justify my reasoning, and discuss the significance and implications of the concepts.

Apply: Present complex, real-world problems that necessitate applying multiple concepts in combination. Guide me through strategic thinking to solve these problems.

Understand and Remember: Reinforce foundational knowledge as needed to support higher-level thinking, ensuring that I have a solid grasp of essential facts and concepts.

Please focus on engaging me in thoughtful dialogue, providing explanations, and prompting me to think critically about the subject matter. Your goal is to facilitate a deep, nuanced understanding that goes beyond memorization."

Topic: 

section 1.1 focuses on comparing and contrasting the various types of security controls so this is a fairly short but very important section so we'll start with the categories which include technical managerial operational and physical now what's different here versus past versions of the exam and other exams out there is the inclusion of the operational category really just a more granular way of considering the control types which have not changed they are preventive deterrent detective corrective compensating and directive I'll give you two bits of advice for exam day number one you should know some examples of each for the exam I'll help there and know that controls can fit into multiple types based on the context of the situation I see folks get wound up on this fact as they're working through their practice exams and their exam prep I'll take you through a logical way to think about this to ensure you can get the right answer on control related questions on exam day so we'll start with categories of security controls we have technical controls these are Hardware or software mechanisms used to manage access to resources and systems and to provide protection for those resources and systems next we have physical these are security mechanisms focused on providing protection to the facility and Real World objects then we have managerial which are the policies and procedures administrative controls really defined by an organization's security policy managerial controls use planning and assessment methods to review the organization's ability to reduce and manage risk and then we have that operational category which helps to ensure that the day-to-day operations of an organization comply with their overall security primarily implemented and executed by people instead of systems I think of operational as people enforcing the managerial controls supporting physical security and using the technology we've implemented through technical controls to ensure that we comply with our overall security strategy let me give you some examples here we'll start with technical we have encryption smart cards passwords Biometrics Access Control list firewalls routers intrusion detection and prevention again it's the technology next we have the physical guards fences lights motion detectors dogs cameras alarms locks protecting what we can touch next we have managerial policies and procedures hiring practices background checks data classification security training risk assessments vulnerability assessments but the focus here is all of these practices laid out in policies and procedures the organization follows and then we have the operational category which would include things like conducting the awareness training configuration management media protection the doing so to summarize those a couple of different ways we have technical which is the implementation of the hardware and software technology the physical controls which are tangible touchable managerial controls which are really policy and procedure based the processes documented and then the operational people doing stuff so to visualize these categories we have our assets the focus of our protection and we have our managerial Technical and physical controls of we're looking at this historically the policies which give us guidance on the what the technical controls we implementing the hardware and the software to help with the how and then a layer of physical security around our facilities devices and other assets it's important to remember there is no security without physical security if I can get into your facility get into your data center get into your wiring closet there is no technical control that can then stop me there is no managerial policy that's going to prevent me from doing damage as an attacker now let's insert that operational layer people Centric activities conducting the awareness training ensuring the backups have completed making sure the media is stored appropriately so we can use it for Recovery when necessary implementing the managerial policies supporting the technology and the physical and while these categories are important it's really the types of controls that are going to come up in questions on the exam but before we dive into control types I want to sync on the definition of a security control security controls are security measures for countering and minimizing loss or unavailability of services or apps due to vulnerabilities you'll often hear the terms safeguards and countermeasures used interchangeably but to put a finer point on it safeguards are proactive controls they reduce the likelihood of occurrence and counter measures are reactive they reduce impact after occurrence of the security event now let's dive into control types we have the deterrent control which is deployed to discourage violation of security policies preventive controls deployed to thwart or stop unwanted or unauthorized activity from occurring detective controls deployed to discover or detect unwanted or unauthorized activity compensating controls which provide options to other existing controls to Aid in enforcement of sec security policies they're supporting or redundant controls next we have corrective controls which modify the environment to return systems to normal after an unwanted or unauthorized activity has occurred and directive which direct confine or control the actions of subjects to force or encourage compliance with our security policies and you'll notice I've highlighted the key descriptors of each type along the way here that you'll want to remember for the exam now let's look at some examples of control types together we have preventive controls deployed to stop unwanted activity and examples here include fences locks Biometrics alarm systems data classification penetration testing access control all of which can prevent unwanted Behavior next we have deterrent controls deployed to discourage violation of security policies this control picks up where prevention leaves off are examples here locks fences security badges guards lighting cameras alarms separation of Duty security policies and security awareness training do you notice the overlap in control types here the fact of the matter is every security control is generally going to fall into one control category but will map to multiple control types and that lock while preventive is also Al a deterrent it is a psychological barrier locks create a visible and tangible barrier even if the lock is unlocked if I have a pad lock that's even unlocked and hanging there on a gate that sends a signal that not just anybody should be walking through there and it also conveys increased perceived effort when it is locked it makes the would be trespass or think twice but stick with me and I'll show you how to navigate the overlap on the exam here in a moment and next we have detective controls deployed to discover these include security guards dogs motion detectors job rotation mandatory vacation audit Trails intrusion detection these all allow us to detect or discover unwanted activity directive which direct confine or control actions policies and procedures standards guidelines physical signage directing Behavior verbal instructions contracts and agreements all intended to direct or encourage a specific behavior corrective controls which restore systems to normal backups and restores patching antivirus or antimalware forensic analysis disciplinary action all play a direct or indirect role in returning our systems and environment back to normal and finally compensating controls which provide options to existing controls to Aid in enforcement and supporting our security policy they are additional backup supporting controls these could include security policies Personnel supervision monitoring work task procedures and when I say security policies that could be anything from segregation of Duties to dual control mandatory vacations background checks all right so it's time to address the overlap we see here in type so we have one control that maps to multiple types or functions and you saw it in those previous examples a single security control can be identified as multiple types depending on the context of the situation and that is just a fact of life security controls are designed to work together and their functions often overlap for example a security camera system is both deterrent it deters unwanted entry and detective it records potential security incidents for later review if as a deterrent it doesn't do its job successfully so context matters the classification of a control can depend on how it's implemented and the specific risk it's addressing so a context based example we have an access control list that can be primarily preventive if it blocks unauthorized access or detective if it mainly logs access in a scenario for later investigation perhaps the access control list showed that an individual should be granted access to the file repository but they then deleted sensitive data that shouldn't have been deleted well at that point the activity was logged and can be investigated later so when we take this knowledge to the exam it comes down to the language exams often use specific words or phrases to hint at a control type so let's look at some keywords for each of the six types that you can use to reason your way to the right answer on an exam words like warning aign visibility perception these indicate a deterrent control preventative Access Control authentication firewall encryption these all prevent access these are preventive in nature we have policy procedure standard guideline all designed to direct good behavior so they are directive monitoring auditing logging alerting all designed to detect Behavior so that's a detective control backup restore incident response patching all correcting negative conditions a sure sign of a corrective control and alternative backup redundancy supporting all signs of a compensating control so keep this information in mind and I think security control related questions on the exam should be quite easy for you to get through successfully