Security Technology and Controls (Network, Host, Application, Data)
What to know cold
Be able to choose controls by layer. Network: firewalls, IDS/IPS, NAC, segmentation, VPN. Host: hardening, patching, EDR, allow-listing, full-disk encryption. Application: secure SDLC, input validation, parameterised queries, authentication and session management, SAST/DAST. Data: classification, encryption at rest and in transit, key management, DLP, backup and retention. Understand AAA, least privilege, separation of duties, and defence in depth. Know the strengths and limits of each: encryption protects data if the key is safe; DLP detects patterns but misses unstructured data; allow-listing blocks unknown binaries but needs maintenance.
Traps that show up in questions
- Choosing encryption when the threat is authorised misuse by a valid user - access control and monitoring fit better.
- Assuming IDS blocks traffic; only IPS does.
- Treating input validation as sufficient for injection without parameterised queries.
- Confusing hashing (integrity, one-way) with encryption (reversible with key).
- Forgetting key management: encryption without key control is theatre.
Rule of thumb
Identify the asset, the threat, and the layer, then pick the control that acts at that layer and can be maintained. Prefer controls that are preventive where the threat is frequent, detective where prevention is impractical.
Worked example
A database is queried by a web app. Stored procedures and parameterised queries remove injection at the application layer; a WAF adds a detective/preventive layer; least-privilege database accounts limit impact if both fail; encryption at rest protects stolen media. Each addresses a different failure mode, which is defence in depth.