Security Controls and Implementation
Controls are safeguards that reduce risk, and candidates must classify them. By nature they are preventive (stop an event), detective (identify it), corrective (fix it) or deterrent (discourage it). By type they are physical, technical or administrative. Common examples include access control, encryption, firewalls, intrusion detection, backups, and awareness training. Implementation requires planning: define requirements, select proportionate controls, test, deploy and monitor. Least privilege, separation of duties, defence in depth and secure defaults are guiding principles.
Identity and access
Authentication verifies identity through something you know, have or are; authorisation determines what you may do; accounting logs activity. Multi-factor authentication combines different factor types. Access control models include discretionary, mandatory and role-based access control. Physical controls such as locks, CCTV and environmental protection are equally examinable.
Traps and worked example
Questions often ask you to classify a control. Is a firewall preventive or detective? It is primarily preventive. Is a log review detective? Yes. Encryption is preventive against disclosure but does not stop data loss on its own. Worked example: a company installs CCTV and alarm systems to discourage intruders; these are both deterrent and detective physical controls. Rule of thumb: identify what the control does at the moment of an event, then classify by nature and type. Also remember controls must be tested and reviewed, because an untested control gives false assurance and may degrade over time.