DrillUnit 5 · Topic 5.6
Detection drill: pick the best detective control
Pick the best detective control for each situation.
New to this? Read the topic first: 5.6 Detecting Attacks on Data and Applications.
Simulation · [5.6.A.2, 5.6.B.1, 5.6.C.1, 5.6.C.2, 5.6.C.3]
Detection drill: pick the best detective control
Choose the detective control that best fits each need. Think about cost, how fast it alerts, and what it can miss.
-
A small nonprofit with almost no budget wants an instant alert if anyone goes looking for donor card numbers.
Show the answer
Honeypot file. Inexpensive and near instantaneous: no one has a legitimate reason to open a fake "donor_cards" file.
-
A national insurer wants to monitor how every employee accesses, uses and sends customer data, and can afford a third-party service.
Show the answer
Data loss prevention (DLP) service. DLP monitors data access, usage and transmission across the organization: strong detection at a higher cost.
-
An administrator wants to prove that the installer files on a download server have not been changed since release.
Show the answer
Cryptographic hash comparison. A changed hash shows a changed file. It is inexpensive, but it finds changes only after they happen.
-
After a breach was reported in the news, a company wants to find out which accounts opened the leaked files last month.
Show the answer
Retrospective log analysis. Reviewing past logs identifies attacks after they have occurred.
Go to the topic: 5.6 Detecting Attacks on Data and Applications