ISC2 Certified in Cybersecurity (CC)Security PrinciplesMedium
A company policy states that all employees must use a strong password of at least 12 characters, including uppercase, lowercase, numbers, and symbols. This policy is then specifically implemented through an automated system that enforces these rules during password creation and periodic changes. Which type of security control does the automated system represent?
- ATechnical control
- BPhysical control
- CCompensating control
- DAdministrative control
Show answer & explanationAnswer & explanation
Correct answer: A. Technical control
Technical controls are security safeguards that are implemented through hardware, software, or firmware. An automated system enforcing password rules is a software-based mechanism, making it a technical control.
Why the other options are wrong
- B. Physical controls are tangible measures like locks or fences, which are unrelated to password enforcement.
- C. Compensating controls are alternative controls used when a primary control is not feasible, which isn't the case here.
- D. Administrative controls are policies, procedures, and guidelines, which the initial policy statement represents, not the automated system.
Technical Control
Security safeguards implemented through hardware, software, or firmware that enforce security policies.
- Automated and often invisible to the end-user.
- Examples include firewalls, intrusion detection systems, encryption, and access control lists.
- Works in conjunction with administrative and physical controls.
Memory trick: Admin tells you what to do, Physical locks it down, Technical does it automatically.