Cyber Security Controls and Measures
What this domain tests
Controls and Measures asks you to select and justify safeguards. You need to match a control to the risk, name its type, and explain why one control is not enough. The exam favours layered, proportionate controls over single 'silver bullet' answers.
Core rules and concepts
- Control categories: preventive (stops), detective (finds), corrective (recovers); administrative (policies, training), technical (firewalls, encryption), physical (locks, guards).
- Defence in depth: layer controls so one failure does not expose the asset. Combine people, process and technology.
- Least privilege and segregation of duties: give the minimum access needed and split sensitive tasks so one person cannot complete a fraudulent action alone.
- Access control models: discretionary (owner decides), mandatory (labels/clearance), role-based (job function). Authentication proves identity; authorisation decides access; accounting/auditing records activity.
- Cryptography: symmetric encryption uses one shared key and is fast; asymmetric uses a public/private pair for key exchange and signatures; hashing is one-way and checks integrity, not confidentiality. TLS protects data in transit.
- Network controls: firewalls filter traffic, IDS detects suspicious activity, IPS can block it, segmentation limits lateral movement, VPNs protect remote traffic.
- Backup and recovery: follow 3-2-1 (three copies, two media, one off-site) and test restores. An untested backup is an assumption.
Worked example
A laptop containing client data is stolen from a car. The risk is confidentiality loss and possible regulatory notification. Preventive controls: full-disk encryption, strong screen lock, cable lock and a policy banning data storage in vehicles. Detective controls: mobile device management (MDM) reports the device missing and logs access attempts. Corrective controls: remote wipe, key revocation and restore of the user's data from backup. Encryption does not stop the theft; it reduces the impact if the thief tries to read the disk. The best answer names the control type and the risk it addresses.
Traps that cost marks
- Choosing encryption to 'prevent' a stolen laptop. It mitigates disclosure; it does not prevent theft.
- Mixing IDS and IPS: IDS alerts, IPS blocks.
- Treating hashing as encryption. Hashes cannot be reversed to plaintext.
- Forgetting to test backups. Restore testing is part of the control.
- Applying least privilege only to administrators. All users need it.
- Assuming a firewall alone is defence in depth.