7.7 Detection & Preventive Security Controls

Key Takeaways

CISSP 7.7 focuses on operating and maintaining detection and preventative security measures.

The current CISSP outline explicitly includes firewalls, IDS/IPS, whitelisting/blacklisting, third-party security services, sandboxing, honeypots/honeynets, anti-malware and machine-learning/AI-based tools.

Prevention and detection are different security-control functions.

Preventive controls attempt to stop unwanted activity from succeeding.

Detective controls identify potentially malicious activity so it can be investigated or acted upon.

Some controls perform both functions.

Prevention = stop it. Detection = find it.

Defence in depth means relying on several complementary controls rather than expecting one product to stop every attack.

A firewall controls network communication according to security policy.

Firewall decisions may consider addresses, protocols, ports, connection state, applications, users and other contextual information depending on the technology.

Network firewalls and Web Application Firewalls operate at different levels.

A network firewall can permit HTTPS while a WAF separately identifies a malicious HTTP request carried inside that permitted service.

Network firewall = should this network communication occur? WAF = is this web request appropriate?

Next-generation firewalls can combine traditional firewall capabilities with deeper application and threat inspection.

Advanced technology does not compensate for poor configuration.

Firewall policy should follow business requirements and least privilege.

Default-deny approaches allow explicitly required communications and deny other traffic.

Ingress controls traffic entering a network or security zone.

Egress controls traffic leaving it.

Egress filtering can help prevent or identify compromised systems communicating with attacker infrastructure.

Firewall rules require lifecycle management.

Rules should be requested, justified, approved, implemented, tested, monitored, reviewed and removed when no longer required.

Temporary rules are particularly dangerous when temporary quietly becomes permanent.

Intrusion Detection Systems identify potentially malicious activity.

Intrusion Prevention Systems can detect malicious activity and also attempt to stop it.

IDS = detect and alert. IPS = detect and attempt to prevent.

Passive sensors can observe copies of network traffic.

Inline controls sit in the enforcement path and can directly influence traffic.

Network-based detection focuses on communications.

Host-based detection provides visibility into activity occurring on individual systems.

Signature-based detection identifies known malicious patterns.

Anomaly or behaviour-based detection identifies activity that differs from expected patterns.

Signature = have I seen this malicious pattern? Anomaly = does this behaviour look unusual?

Unusual does not automatically mean malicious.

A false positive occurs when harmless activity is incorrectly identified as malicious.

A false negative occurs when malicious activity is incorrectly treated as benign or remains undetected.

False positive = alarm without attack. False negative = attack without alarm.

Excessive false positives create alert fatigue and consume analyst resources.

Detection tuning attempts to improve useful signal while preserving important coverage.

Detection should evolve as applications, users, networks and threats change.

The CISSP outline still uses the terms whitelisting and blacklisting.

Modern documentation also commonly uses allowlisting and blocklisting or denylisting.

Allowlisting defines what is permitted.

Blocklisting defines what is prohibited.

Allowlist = known or approved good. Blocklist = known bad.

Application allowlisting can prevent execution of software that is not explicitly authorised.

This can be very powerful where the authorised software set is reasonably controlled.

It also requires good change management because legitimate applications and versions change.

Blocklists are useful for known malicious domains, addresses, hashes, applications and other indicators.

However, a blocklist cannot automatically recognise malicious infrastructure that has never been identified before.

Third-party security providers can deliver detection and preventive capabilities.

Examples include managed security monitoring, managed detection and response, DDoS protection, cloud WAF, email filtering and DNS security.

Provider responsibilities should be clearly defined.

Organisations should understand what is monitored, when monitoring occurs, how alerts are escalated, what actions the provider may perform and what information remains available to the customer.

Outsourcing the security service does not outsource accountability for organisational risk.

Sandboxing provides a restricted environment for executing untrusted or suspicious code.

Security systems can observe file, process, network and persistence behaviour before deciding whether the content should be permitted.

Sandbox results are not absolute proof that software is safe.

Malware can attempt to identify analysis environments and hide its malicious behaviour.

This is commonly known as sandbox evasion.

The sandbox itself must also be securely isolated because vulnerabilities in the isolation mechanism can create sandbox-escape risk.

Honeypots are deceptive systems or resources designed to attract suspicious activity.

Honeynets extend the deception concept across multiple systems or an apparent network.

Honeytokens apply similar thinking to deceptive information such as fake credentials, keys or records.

Honeypot = fake system. Honeynet = fake network. Honeytoken = fake information.

Because legitimate users should have little reason to interact with properly designed deception resources, such activity can generate useful security signals.

Honeypots must be appropriately isolated so a compromised decoy cannot become an attack platform against production systems.

Anti-malware technology can use signatures, heuristics, behavioural analysis and reputation information to identify malicious software.

Prevention capabilities may block or quarantine malicious programs before they execute successfully.

Modern endpoint protection and EDR capabilities can extend beyond traditional antivirus by providing behaviour telemetry, investigation, threat hunting and response functions.

Anti-malware protection should be maintained and monitored.

Security teams should know whether the agent is installed, running, updated, correctly configured and communicating with its management service.

Installed ≠ healthy. Healthy ≠ current. Current ≠ effective.

Attackers can attempt to disable security controls, including endpoint agents, logs and firewall policies.

Unexpected loss of a security control can therefore itself be valuable security telemetry.

Machine-learning and AI-based tools can analyse large quantities of security information and identify patterns, anomalies and correlations.

Possible uses include malware classification, behaviour analytics, alert prioritisation, network anomaly detection and analyst assistance.

AI-based detection still produces false positives and false negatives.

Its output should therefore be interpreted according to context and risk.

Behavioural models can lose effectiveness when normal organisational behaviour changes.

This creates the need to consider model and behavioural drift.

Attackers may also deliberately modify their behaviour to evade detection.

Automated preventive action should consider both:

detection confidence and consequence of being wrong.

A low-confidence automated decision that shuts down a critical service can itself cause substantial business harm.

"Operate and maintain" is an important part of the 7.7 objective.

Controls should be monitored for health, coverage, configuration, updates, tuning and effectiveness.

Security teams should understand which assets are actually protected.

A control cannot protect an asset it does not cover.

Sensor placement influences visibility.

Internet-edge monitoring alone may not identify lateral movement between internal systems.

Encrypted traffic also changes what network controls can inspect.

Endpoint telemetry, application logs, flow information and appropriately designed inspection points can provide complementary visibility.

Inline security controls can create availability dependencies.

Fail-open behaviour prioritises continued communication when the control fails but may allow traffic to bypass inspection.

Fail-closed behaviour denies communication when the control fails but can affect availability.

Critical inline controls may therefore require resilient architectures.

Changes to firewalls, IPS rules and other preventive technologies should be controlled and tested.

An incorrectly configured security control can block legitimate business activity just as effectively as it blocks an attacker.

Security measures should therefore be tested rather than merely assumed to work.

Installed ≠ enabled. Enabled ≠ configured correctly. Configured correctly ≠ proven effective.

Detection and preventive controls work best as layers.

A firewall may miss an application attack that a WAF catches.

A WAF may miss malware that endpoint security catches.

Endpoint security may miss behaviour that identity analytics detects.

The central CISSP principle is: deploy layered preventive and detective measures, understand what each control can and cannot see, keep the controls healthy and current, tune them to the environment and verify regularly that they provide the protection you expect.