8.4
Which preventive, detective, and/or corrective controls would best mitigate the following
threats?
a. An employee’s laptop was stolen at the airport. The laptop contained personally
identifying information about the company’s customers that could potentially be used to
commit identity theft.
Preventive: Policies against storing sensitive information on laptops and requiring that if
any such information must exist on the laptop that it be encrypted.
Training on how to protect laptops while travelling to minimize the risk of theft.
Corrective: Installation of “phone home” software might help the organization either
recover the laptop or remotely erase the information it contains.
b. A salesperson successfully logged into the payroll system by guessing the payroll
supervisor’s password.
Preventive: Strong password requirements such as at least an 8 character length, use of
multiple character types, random characters, and require that passwords be changed
frequently.
Detective: Locking out accounts after 3-5 unsuccessful login attempts; since this was a
“guessing” attack, it may have taken more than a few attempts to login.
c. A criminal remotely accessed a sensitive database using the authentication credentials
(user ID and strong password) of an IT manager. At the time the attack occurred, the IT
manager was logged into the system at his workstation at company headquarters.
Preventive: Integrate physical and logical security. In this case, the system should reject
any user attempts remotely log into the system if that same user is already logged in from a
physical workstation.
Detective: Having the system notify appropriate security staff about such an incident.
