All language subtitles for 004 Controls (OBJ 1.2)

Instructor: In order to protect our networks

and information systems, we utilize various types

of access controls.

Now, access control measures are broken down

into seven different categories, compensative, corrective,

detective, deterrent, directive, preventive, and recovery.

Now, let's discuss each of these categories briefly,

because you're gonna be looking for ways to exploit

all seven of these categories during your penetration test

and then you're gonna be making recommendations

from these seven categories to help remediate

the vulnerabilities that you've found in your assessments.

First, compensative access controls.

Compensative access controls are used

in place of primary access controls

in order to mitigate a given risk.

These controls can be deployed to enforce

and support a security policy.

For example, we might require that two system administrators

perform a certain action, like downloading a copy

of the database to an external device

in order to minimize the risk of a trusted insider

stealing that information.

This mitigation is based on the policy of dual control,

which might be considered an administrative

or managerial control.

Second, corrective access controls.

Corrective access controls are used to reduce the effect

of an undesirable event or attack.

Examples of corrective access controls

include fire extinguishers, antivirus solutions,

and similar measures.

If a fire broke out, then we could correct that issue

by using fire extinguishers, for example.

Third, we have detective measures.

Now, detective measures are used to detect an attack

while it's occurring and notify the proper personnel.

This type of control includes alarm systems,

closed circuit television systems, honey pods,

and other such controls.

Fourth, we have deterrent controls.

Deterrent controls are used to discourage any violation

of the security policies, both to attackers and insiders.

Deterrent controls can go further than detective controls,

because not only do they detect the event

but they also ensure consequences for those actions.

For example, if I posted a sign outside of my house

that says this house has a video camera to record intrusions

this would be a deterrent control.

I'm trying to tell potential burglars that they should go

to another house because if they try to break into mine

I can give that recording to the police

to help identify them and they might get arrested.

In this particular example, the video recording itself

would be considered a detective control,

because it would be used to identify the burglars,

but the sign is actually a deterrent control

by trying to scare them off in the first place.

Fifth, we have directive controls.

Now, directive controls are used to force compliance

with the security policy and practices

within the organization.

The most common directive control

is the acceptable use policy or AUP.

This is gonna dictate what behaviors are

and are not allowed on a company's network systems.

Sixth, we have preventive controls.

Now, preventive controls are those controls

that seek to prevent or stop an attack

from ever occurring in the first place.

Examples of this include protections,

like password protection, security badges,

antivirus software, and intrusion prevention systems.

Seventh, we have recovery control measures.

Now, recovery control measures are gonna be used

to recover device after an attack.

The best known examples of recovery controls

are disaster recovery plans, backups,

and continuity of operation plans.

Now, when we develop security for our networks

we often use the concept of defense

in depth to layer various access controls

on top of each other for additional security.

This can be from the same category

or from various categories.

Now, in order to achieve the goals of defense in depth,

we have to implement security through three broad categories

of access controls.

These are known as administrative, logical, and physical.

The first type of access control

is known as an administrative control.

This is also sometimes called managerial controls.

Now these are controls that are implemented

to manage the organization's personnel

and assets through security policies, standards,

procedures, guidelines, and baselines.

Examples of administrative or managerial controls,

include proper data classification and labeling,

supervision of personnel and security awareness training.

In fact, security awareness training is one

of the most important administrative controls

that any organization can implement.

Studies have shown that many incidents

could have been prevented with proper user training up front

and it is one of the most cost effective ways

to increase the organization's security

and provides the best return on investment.

The second type of access control we have

is known as logical controls.

These are also called technical controls.

These controls are implemented through hardware

or software and they're used to prevent

or restrict access to a given system.

For example, we have things like installing new devices

like firewalls intrusion detection systems,

intrusion prevention systems, authentication schemes,

encryption, new protocols, auditing or monitoring software,

biometrics, and much more.

Auditing and monitoring are both types of logical controls,

but they vary slightly in their use.

Auditing is a one time evaluation of a security posture,

whereas monitoring is an ongoing process

that continually evaluates a system or its users.

For example, a penetration test

is considered a type of audit,

therefore, it is considered a logical control.

All organizations should be aiming

at continually improving themselves in order to become

either more effective, more efficient, or preferably both.

To do this though, the organization must monitor any changes

to their networks in order to understand the risks

associated with those changes.

Often, this will fall under the category

of change management where a baseline is created

and all changes to that baseline are tracked and assessed.

Before those changes are implemented though

they should be analyzed for risk

through the risk management program.

To conduct efficient continuous monitoring,

organizations need to automate the process

as much as is practical.

For example, the collection of logs from security systems,

applications, and network suites should always

be automatically collected, correlated and triaged

by software before being displayed

to a cyber security analyst.

Continuous monitoring also includes overseeing

the change management process,

configuration management process, monitoring logs,

and analyzing the status reporting that's being collected

across the organization.

This allows the security professionals to evaluate

the effectiveness of their existing security controls

and make recommendations for improved controls

if they're warranted.

Now, the third type of access control

we have is physical controls.

These are controls that are implemented

to protect the organization's personnel

and their facilities.

Examples of physical controls include fences, locks,

security badges, proximity cards for entry

into the building guards, access control vestibules,

biometrics, and other means of securing the facility.

So in summary, it's important to remember the seven

different types of access control categories,

which are compensative, corrective, detective,

deterrent, directive, preventive and recovery.

Also, you wanna remember the three types of access controls,

which are administrative, logical, and physical.

Some controls may work across multiple categories

and types as well, and that's okay.

When you're doing your planning, you should think

through each of these categories to identify

which type of controls you're gonna be focused on

exploiting during your upcoming penetration test

as you work with the client to determine what things

will or will not be tested during your engagement.