Classify twelve controls into the right category

short · 35 min · Objective 4.1

Task

Sort twelve real security controls by both dimensions the exam uses — the CIA property each protects, and whether the control is technical, physical or administrative. Classification questions are pure marks, and the second dimension is the one candidates fumble.

Steps

  1. Classify each control by which of confidentiality, integrity or availability it primarily protects: full-disk encryption; a load balancer with two backends; a file checksum; a locked server-room door; TLS on a web server; a UPS; code signing; role-based access control; an off-site backup; a digital signature; a firewall rule permitting only port 443; RAID 1.
  2. Note that several protect more than one. Choose the primary one and be able to defend it — that is exactly what an exam question is testing.
  3. Now classify each by control type: technical (enforced by technology), physical (enforced by the building), or administrative (enforced by policy and process).
  4. Add the third dimension the exam sometimes uses: is each control preventive, detective or corrective? A firewall prevents, an IDS detects, a backup corrects.
  5. Find the one control in the list that is none of the above until a person acts on it, and say why that matters.

Verify

python3 -c "
rows = [('full-disk encryption','C','technical','preventive'),
 ('load balancer, two backends','A','technical','preventive'),
 ('file checksum','I','technical','detective'),
 ('locked server-room door','C','physical','preventive'),
 ('TLS on a web server','C','technical','preventive'),
 ('UPS','A','physical','corrective'),
 ('code signing','I','technical','preventive'),
 ('role-based access control','C','technical','preventive'),
 ('off-site backup','A','administrative','corrective'),
 ('digital signature','I','technical','detective'),
 ('firewall permitting only 443','C','technical','preventive'),
 ('RAID 1','A','technical','corrective')]
for n, cia, typ, fn in rows:
    print(f'{n:<30}{cia}  {typ:<16}{fn}')
"

Twelve rows, three classifications each. The ones worth arguing about are the checksum and the digital signature: both protect integrity, and both are detective rather than preventive, because they tell you something changed rather than stopping the change.

Notes

The off-site backup is the item that is administrative rather than technical, and the distinction is worth holding: the technology is a backup tool, but what makes it a control is the policy that says it happens, where it goes, and how often it is tested.

The CIA triad is the organising idea of domain 4 and it is worth using actively. When you meet a new control, ask which property it protects and you will usually also know what attack it counters. Confidentiality controls counter disclosure; integrity controls counter tampering; availability controls counter denial.

The pairing with AAA — authentication, authorization and accounting — comes next. Authentication proves who you are, authorization decides what you may do, and accounting records what you did. A control that does one is often mistaken for one that does all three, and lesson 34 separates them.