Cybersecurity CompTIA 1.1 - Security Controls

Technical Controls (Logical Controls)

Security controls implemented with technology or technical mechanisms. (Examples: firewalls, encryption, MFA, IDS/IPS)

Firewalls

Monitors and filters incoming and outgoing network traffic based on security rules. (Blocks unauthorized network connections, Allows approved traffic, Protects networks from hackers)

Firewall Logs

Records of attempted or established connections for incoming traffic from the internet. It also includes outbound requests to the internet from within the network. (Source IP, Destination IP, Port numbers, Protocol, Allowed or blocked, Date and time)

Multi-Factor Authentication (MFA)

Requires users to provide two or more forms of authentication before accessing an account. Makes stolen passwords much less useful. (Something you know (password), Something you have (phone/security key), Something you are (fingerprint))

Intrusion Detection System (IDS)

Monitors network traffic and alerts administrators about suspicious activity. (Detects attacks, Sends alerts, Does not stop attacks)

Intrusion Prevention System (IPS)

Monitors network traffic and automatically blocks malicious activity. (Detects attacks, Stops attacks automatically)

Antivirus/Anti-malware

Software that detects, blocks, and removes malicious software. (Scans files, Removes viruses, Stops malware infections)

Encryption

Converts readable data (plaintext) into unreadable data (ciphertext). Protects data even if it is stolen.

Access Control Lists (ACLs)

Rules that determine which users or devices can access resources.

VPN (Virtual Private Network)

Creates an encrypted connection between a device and a network.

Managerial Controls (Administrative Controls)

Policies, procedures, planning, and decision-making processes created by management. These tell employees what they are supposed to do.

Security Policies

Written rules that explain security expectations.

Risk Assessments

Identifying and evaluating risks to an organization.

Security Awareness Training

Teaching employees how to recognize cyber threats.

Incident Response Plan

A documented plan explaining how to respond to cybersecurity incidents.

Operational Controls

Day-to-day procedures carried out by people to maintain security. Operational controls involve performing the work. (Example: Security Guards, Backups, Account reviews, Incident response, change management)

Physical Controls

Protect buildings, equipment, and people from unauthorized physical access.(Example: Locks, CCTV, Badge Readers, Fences, Biometric scanners)

Mantraps

A small secured room with two locking doors that only allows one person through after identity verification.

Preventive Controls

Stop security incidents before they happen. (Firewall, MFA, Encryption, Door locks, Antivirus, ACLs, Strong passwords)

Deterrent Controls

Discourage attackers or users from attempting malicious actions. (Security cameras, Warning signs, Security guards, Login banners, Bright lighting, Visible fences)

Detective Controls

Identify or discover security incidents after or while they occur. (IDS, Security cameras, SIEM, Log monitoring, Motion sensors, Security audits)

Corrective Controls

Reduce damage and restore systems after an incident. (Backups, Patching, Antivirus removing malware, Disaster recovery, Incident response, Reinstalling infected systems)

Compensating Controls

Provide an alternative security measure when the preferred control cannot be implemented. (Increased monitoring, Additional MFA, Manual approval process, VPN instead of upgrading an insecure application, Physical security when technical controls aren't possible)

Directive Controls

Guide people by telling them what they should or should not do. (Security policies, Procedures, Employee handbook, Acceptable Use Policy (AUP), Security training, Password policy)