ISC2 CISSP (Certified Information Systems Security Professional)Asset SecurityEasy
A financial institution is implementing a new data loss prevention (DLP) solution. The solution needs to identify and block the transmission of credit card numbers (PANs) and Social Security Numbers (SSNs) from internal systems to external networks. Which data security control category does this DLP solution primarily fall under?
- APhysical Controls
- BTechnical Controls
- COperational Controls
- DAdministrative Controls
Show answer & explanationAnswer & explanation
Correct answer: B. Technical Controls
DLP solutions are software or hardware-based mechanisms that automatically detect and prevent unauthorized transmission of sensitive data. As such, they are a prime example of a technical control.
Why the other options are wrong
- A. Physical controls protect the physical environment (e.g., fences, locks).
- C. Operational controls are mechanisms carried out by people (e.g., security awareness training, incident response).
- D. Administrative controls are policies, procedures, and guidelines.
Technical Controls
Security controls implemented through hardware or software to enforce security policies and protect systems and data.
- Automate security functions.
- Examples: firewalls, IDS, encryption, DLP.
- Directly protect assets.
Memory trick: Admin's Rules, Physical's Walls, Technical's Code, Operational's Calls.