Explain concepts related to control types, risks, and vulnerability management
Control types, risk management principles, secure coding, and the frameworks and standards that govern the programme.
- Reading time
- 22 min read
- Flashcards
- 20 cards
- Practice questions
- 8 questions · 2 PBQs
This objective is the frame around the previous three: the vocabulary of controls, the discipline of changing systems safely, and the frameworks that say what a programme must contain.
It is broad and shallow. Learn the classifications precisely — the exam tests them as classifications — and learn the change process as a sequence.
Classifying controls two ways
Every control gets classified twice, and the exam expects both answers for the same control.
By nature — who or what implements it:
- Managerial — policy, risk assessments, security planning. People deciding.
- Operational — awareness training, incident response, physical security. People doing.
- Technical — firewalls, encryption, access control lists. Systems enforcing.
By function — what it does relative to the event:
- Preventive — stops it happening. A firewall rule, MFA.
- Detective — notices it happened. A SIEM alert, log review.
- Corrective — fixes it afterwards. Restoring from backup, patching.
- Deterrent — discourages the attempt. Warning banners, visible cameras.
- Compensating — an alternative when the primary control is not possible.
Compensating control
A control put in place because the intended one cannot be. It must provide comparable protection, and it does not remove the underlying deficiency. Network isolation and enhanced monitoring around an unpatchable legacy system is the canonical example.
Changing systems without breaking them
Patching is where vulnerability management meets operations, and the sequence is examinable:
- Test in a non-production environment that resembles production
- Plan the rollback before deploying — decide in advance how to undo it
- Implement through the change process, in the agreed window
- Validate that the patch applied and the system still works
- Rescan to confirm the finding is actually closed
Maintenance window
An agreed period when changes may be made and disruption is tolerated. It is negotiated with the business, and it is the practical limit on how fast remediation can move.
Exception
A formal, time-bounded record that a system will not comply with a requirement, with a reason and an owner. Exceptions make non-compliance visible and reviewable — an exception with no expiry date is just a permanent hole with paperwork attached.
Configuration management
Knowing and controlling the configuration of every system, so drift from the approved baseline is detectable. Without it, you cannot tell whether a control is still applied — you can only tell that it was applied once.
Building software that is not vulnerable
Vulnerability management is cheaper the earlier it happens, which is why secure development is in this domain at all.
Secure SDLC
Building security into every phase — requirements, design, implementation, testing, deployment, maintenance — rather than testing for it at the end. A flaw found in design costs a conversation; the same flaw found in production costs an incident.
Threat modelling
Systematically asking, at design time, what could go wrong: what are we building, what can go wrong with it, what are we doing about it, did we do a good enough job. STRIDE is the common taxonomy — spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege.
The secure coding practices that appear by name:
| Practice | What it prevents |
|---|---|
| Input validation | Injection of all kinds — validate on the server, allow-list not deny-list |
| Parameterised queries | SQL injection, by separating code from data structurally |
| Output encoding | Cross-site scripting, by rendering data as data |
| Session management | Session hijacking and fixation |
| Authentication and authorisation | Broken access control — the most common serious web flaw |
| Error handling | Information disclosure through verbose errors |
| Data protection | Exposure of data at rest and in transit |
Check yourself
Which control most reliably prevents SQL injection?
Attack surface management
Continuously identifying and reducing everything an attacker could reach — exposed services, forgotten subdomains, shadow IT, third-party integrations. The smallest attack surface is the one you never have to defend.
Frameworks worth recognising
| Framework | What it is |
|---|---|
| NIST Cybersecurity Framework | Identify, Protect, Detect, Respond, Recover — voluntary, widely adopted, good for structuring a programme |
| NIST Risk Management Framework | A formal seven-step process, mandatory for US federal systems |
| ISO/IEC 27001 | An international, certifiable standard for an information security management system |
| OWASP Top 10 | The consensus list of the most critical web application risks |
| PCI DSS | Mandatory for organisations handling cardholder data; prescriptive, including scan cadence |
| CIS Controls / Benchmarks | Prioritised actions and concrete hardening configurations |
Check yourself
An organisation must certify its information security management system to an international standard recognised by its overseas customers. Which framework fits?