Information Security Technology and Controls
CISM is a management exam, so technology questions test whether you can select and justify a control, not whether you can configure it. You must classify controls by function and by nature, and know which layer of defence reduces likelihood versus impact.
Core rules
- By function: preventive (stops the event), detective (identifies it), corrective (limits damage and restores), deterrent (discourages), recovery (restores service), compensating (substitutes when the primary control is infeasible). By nature: administrative, technical, physical. A single incident usually needs several: firewall rules (preventive), SIEM correlation (detective), backup restore (corrective/recovery).
- Identity and access. Identification, authentication, authorisation, accountability. Enforce least privilege and segregation of duties; prefer role-based access with periodic recertification; MFA for privileged and remote access; privileged access management with session recording.
- Network and architecture. Segmentation and DMZ reduce blast radius; zero trust replaces perimeter trust with per-request verification; IDS/IPS, WAF and egress filtering are complementary, not alternatives. Defence in depth assumes any single layer will fail.
- Cryptography. Symmetric (AES) for bulk data, asymmetric (RSA/ECC) for key exchange and signatures, hashing (SHA-256) for integrity, not confidentiality. Digital signatures give integrity, authentication and non-repudiation, not secrecy. Key management - generation, storage, rotation, destruction - is the usual weak point; HSM protection of keys often matters more than algorithm choice.
- Data protection. Classification drives handling. Encryption at rest protects stolen media; TLS protects transit; tokenisation and masking reduce the value of data if disclosed and can shrink compliance scope.
- Operations. Secure SDLC, change and configuration management, vulnerability scanning with risk-based patch SLAs, hardened baselines, logging with time synchronisation, and tested backups.
Worked example
A legacy payment application cannot support MFA and will not be replaced for 18 months. "Accept the risk" alone is weak. The correct construction: document why the primary control is infeasible, apply compensating controls - strict network segmentation, IP allow-listing, privileged session monitoring, enhanced logging and quarterly access review - record the residual risk with a business owner sign-off and a remediation milestone, and report it to the steering committee.
Traps that cost marks
- Choosing a detective control where the requirement is to stop an event.
- Assuming encryption removes the need for access control or key management.
- Treating a compensating control as permanent without an expiry and remediation plan.
- Confusing hashing (one-way integrity) with encryption (reversible confidentiality).