Information Security and Ethical Hacking · Topic 3 of 3
Controls, Laws and Standards
Review defense in depth, risk management, incident handling, access control types and the laws and standards CEH tests: PCI DSS, HIPAA, SOX, GDPR and more.
- 4 min
- Defense in depth means several layers, so one failure does not expose the asset.
- Controls are preventive, detective, corrective, deterrent or compensating.
- Risk treatment options are avoid, transfer, mitigate and accept.
What it is
Information security controls are the safeguards an organization uses to reduce risk. Laws and standards set the minimum an organization must or should do, and they decide what an ethical hacker may legally touch.
This page covers the layered approach to controls, the risk and response processes, and the laws and standards that the exam names.
How it works
Defense in depth
Defense in depth uses several layers of controls, so that failure of one layer does not expose the asset. Typical layers are policies, physical security, network perimeter, internal network, host, application and data.
Zero Trust is a related model. It assumes no user or device is trusted by default, even inside the network, and it verifies each request.
Types and classes of control
Controls are grouped by function and by form.
| Function | Purpose | Example |
|---|---|---|
| Preventive | Stop an event | Firewall, access control list |
| Detective | Find an event | Intrusion detection, log review |
| Corrective | Repair after an event | Restoring from backup, patching |
| Deterrent | Discourage an attacker | Warning banners, cameras |
| Compensating | Substitute when the usual control is not possible | Extra monitoring on an unpatched legacy server |
By form, controls are administrative (policies, training), technical (encryption, authentication) or physical (locks, guards).
Risk management
Risk is the possibility of loss, from a threat exploiting a vulnerability. The process is cyclical.
Treatment options are to avoid the risk, transfer it (insurance), mitigate it with controls, or accept it. Residual risk is what remains after treatment.
Threat modeling and vulnerability management
Threat modeling is a structured way to find threats during design. STRIDE is a common model, named for Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege.
Vulnerability management is the continuing cycle of finding, ranking, fixing and verifying weaknesses.
Incident handling and response
The CEH incident handling and response process has these stages in order.
Containment limits the spread, eradication removes the cause, and recovery restores normal service. Post-incident review captures lessons learned.
Monitoring and analytics
Security information and event management (SIEM) collects and correlates logs from many sources and raises alerts. User and entity behavior analytics (UEBA) learns normal behavior and flags deviations. Machine learning and artificial intelligence help by sorting large volumes of alerts and spotting patterns, but they still need human judgment.
Laws and standards
| Name | What it covers |
|---|---|
| PCI DSS | Protection of payment card data |
| ISO/IEC 27001 | Requirements for an information security management system |
| HIPAA | Protection of health information in the United States |
| SOX (Sarbanes-Oxley) | Accuracy of financial reporting for public companies |
| GLBA | Privacy and security of customer data at financial institutions |
| FISMA | Security of United States federal information systems |
| DMCA | Copyright, including bans on circumventing copy protection |
| GDPR | Protection of personal data of people in the European Union |
| Data Protection Act 2018 | United Kingdom law that works with the UK GDPR |
GDPR fines can reach 20 million euro or 4 percent of worldwide annual turnover, whichever is higher, for the most serious breaches. ISO/IEC 27001 is certified by auditors, while ISO/IEC 27002 gives guidance on the controls.
The NIST Cybersecurity Framework groups outcomes into functions such as Identify, Protect, Detect, Respond and Recover, and version 2.0 adds Govern.
A worked example
A retailer stores customer card numbers. A security team adds network segmentation (preventive), a log monitoring tool (detective) and a tested backup process (corrective). The auditor checks the setup against PCI DSS. If a breach still occurs, the team follows the incident process, notifies the right parties and reviews what went wrong.
How the exam asks about this
- "Which standard protects payment card data?" -> PCI DSS.
- "A warning banner on a login screen is which kind of control?" -> Deterrent.
- "Which incident response stage removes the root cause?" -> Eradication.
What to remember for the exam
- Defense in depth means several layers, so one failure does not expose the asset.
- Controls are preventive, detective, corrective, deterrent or compensating.
- Risk treatment options are avoid, transfer, mitigate and accept.
- Containment comes before eradication, and eradication before recovery.
- Match laws to topics: HIPAA health, SOX financial reporting, GLBA financial customers, FISMA federal systems, GDPR EU personal data.
PCI DSS is an industry standard from the card brands, not a government law, even though it is enforced through contracts.
Common mistakes
Calling a backup restore a preventive control. Restoring after an event is corrective.
Confusing ISO 27001 with ISO 27002. The first is the management system requirement that is certified, and the second is guidance on controls.
Skipping notification and triage in the response order. Those stages come early, before containment.
Check yourself
Which law protects health information in the United States?
HIPAA.
What are the four risk treatment options?
Avoid, transfer, mitigate and accept.
What does a SIEM do?
It collects and correlates logs from many sources and raises alerts on suspicious patterns.
Topic 3 of 3 in Information Security and Ethical Hacking
Test yourself on Information Security and Ethical Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.