CRISC Certified in Risk and Information Systems ControlRisk Response and ReportingMedium
An organization has implemented an intrusion detection system (IDS) to alert security personnel of suspicious network activity. This IDS is configured to log all alerts and send notifications to a security operations center (SOC) for immediate review. What type of control is this IDS primarily functioning as?
- ADetective
- BCorrective
- CCompensating
- DPreventive
Show answer & explanationAnswer & explanation
Correct answer: A. Detective
An IDS primarily detects and alerts on incidents after they have occurred or are in progress, rather than preventing them from happening in the first place. This makes it a detective control.
Why the other options are wrong
- B. A corrective control would fix the problem or restore systems after an incident. The IDS itself does not correct.
- C. A compensating control provides an alternative when a primary control is not feasible or effective. This is a primary control for detection.
- D. A preventive control would stop the suspicious activity from occurring. An IDS only alerts after the fact.
Detective Control
A control designed to identify and flag unwanted events that have occurred or are occurring, allowing for a timely response.
- Identifies incidents post-occurrence or during progress
- Does not prevent the event itself
- Examples include IDS, audits, log monitoring
Memory trick: PDC: Prevent, Detect, Correct – the control trifecta!