Security Operations · Topic 6 of 9
Detection and Preventative Measures
Firewalls, IDS and IPS, allow and deny lists, third-party security services, sandboxing, honeypots, anti-malware and machine learning tools in security operations.
- 3 min
- Default-deny firewalls and allow listing are the strongest preventive defaults.
- Signature detection finds known threats; anomaly detection finds new ones but needs baselines.
- Sandboxes analyze unknown files; honeypots give high-fidelity alerts.
What it is
Detection and preventative measures are the operational tools that stop attacks or reveal them quickly. They must be operated and maintained: rules tuned, signatures updated, exceptions reviewed and coverage checked. A tool left untuned becomes noise or a blind spot.
How it works
The measures
| Measure | Purpose | Operating notes |
|---|---|---|
| Firewalls (network, host, next-generation, WAF) | Allow only approved traffic | Default deny; review rules; remove stale rules |
| IDS / IPS | Detect or block attacks | Signature-based finds known attacks; anomaly-based finds new ones but needs a good baseline |
| Allow listing (whitelisting) | Only approved applications run | Strong against malware; needs maintenance |
| Deny listing (blacklisting) | Block known-bad items | Easy but misses new threats |
| Third-party security services | Managed detection and response, managed firewalls, cloud security services | Contract for visibility and response times; keep your own oversight |
| Sandboxing | Run suspicious files in isolation to observe behaviour | Catches unknown malware; some malware detects sandboxes |
| Honeypots and honeynets | Decoys that attract attackers | Any interaction is suspicious; must be isolated; avoid entrapment issues |
| Anti-malware and EDR | Detect and respond on endpoints | Combine signature and behaviour-based detection |
| Machine learning and AI-based tools | Find anomalies and patterns at scale | Need quality data and tuning; can produce false positives |
Allow listing is more secure than deny listing because unknown items are blocked by default. It costs more effort to maintain.
Diversity of defense
Defense in depth works only if layers fail independently. If the mail gateway, web proxy and endpoints all use the same detection engine, one evasion beats all three. Add a behaviour-based control that works differently.
Tuning without blinding
| Problem | Good response | Poor response |
|---|---|---|
| Recurring false positives from a known business process | Adjust the baseline or write a narrow, documented exception | Lower sensitivity across the whole sensor |
| Too many alerts | Prioritize by asset criticality and confidence; automate triage | Disable rule sets |
| New threat reported | Add detection and hunt for past activity | Wait for the vendor |
Managed and third-party services
Outsourcing detection gives 24x7 coverage and expertise, but accountability stays with the organization. Define what the provider monitors, how fast it escalates, what logs it can see, and how you verify its performance.
Honeypot considerations
Honeypots should be isolated so attackers cannot pivot from them. Their value is high-fidelity alerts: legitimate users have no reason to touch them. Legal counsel should review their use; enticement (making a target attractive) is acceptable, entrapment (inducing a crime) is not.
How the exam asks about this
- "Only approved programs may run on kiosks." Application allow listing.
- "Analyze an unknown attachment's behaviour safely." Sandboxing.
- "Anomaly IDS flags month-end transfers every month." Extend the learning period so the baseline includes month-end cycles.
What to remember for the exam
- Default-deny firewalls and allow listing are the strongest preventive defaults.
- Signature detection finds known threats; anomaly detection finds new ones but needs baselines.
- Sandboxes analyze unknown files; honeypots give high-fidelity alerts.
- Outsourced detection does not outsource accountability.
- Tune narrowly; never blind sensors to stop noise.
An IPS that is too aggressive can block legitimate business traffic. Test rules before switching from detect to prevent mode.
Common mistakes
Disabling detections to cut noise.
Assuming a managed service removes your responsibility.
Using identical engines at every layer.
Check yourself
Why is allow listing stronger than deny listing?
Anything not explicitly approved is blocked, including new unknown threats.
What is the main value of a honeypot?
Any interaction with it is suspicious, giving high-fidelity alerts and insight into attackers.
What is the difference between enticement and entrapment?
Enticement makes a target attractive to someone already intending to attack; entrapment induces someone to commit a crime they did not intend.
Topic 6 of 9 in Security Operations
Test yourself on Security Operations
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.