M01-06 · Security controls and defense in depth

CEH M01-06 | Security Controls and Defense in Depth

Security Controls & Defense in Depth

Module 01: Introduction to Ethical Hacking

Learning objective: Understand how security protection works, the purposes of different security controls, and why failure of one protection should not cause the entire system to fall.

This is an important foundation of CEH Module 01. EC-Council's official curriculum also lists Information Security Controls among this module's learning topics. EC-Council

1. Conclusion first: security is not about finding one defense that never fails

Start with three ideas today:

1. Security Controls: what protections do we actually put in place to reduce risk?

2. Defense in Depth: if the first protection fails, can other protections continue to safeguard the assets?

3. Security Control Effectiveness: how do we demonstrate that these protections actually work?

Consider an everyday example.

Suppose you run a bank with a large amount of cash in its vault.

How would you protect that cash?

You might design:

- Layer one: an access card is required at the bank entrance.

- Layer two: the vault requires separate identity verification.

- Layer three: entering the vault does not permit unrestricted opening of every safe-deposit box.

- Layer four: cameras and alarm systems monitor abnormal behavior.

- Layer five: response procedures and necessary recovery arrangements are available when an incident occurs.

These measures do different jobs.

Access control restricts entry, cameras provide observational records, alarms draw attention to abnormalities, and response procedures help contain damage.

The key to defense in depth is not the number of controls, but whether different controls can continue working when others fail.

NIST's definition of defense in depth also emphasizes integrating people, technology and operational capabilities to establish multiple layers of security barriers. NIST Computer Security Resource Center

2. What are security controls?

1. Moving from risk to protection

Do you remember the four concepts from M01-02?

Clarification | The risk row emphasizes harm. A complete assessment considers both likelihood and impact; it is not only a monetary-loss estimate or a mechanical sum. NIST risk definition

Think of the overall reasoning process as:

Valuable assets
      |
      v
Identify possible threats
      |
      v
Identify weaknesses and potential impacts
      |
      v
Assess risk
      |
      v
Select appropriate security controls
      |
      v
Verify whether the controls work
      |
      v
Reassess residual risk

This is a simplified risk-management process.

Security controls are not necessarily software. They can also be rules, workflows, hardware or even personnel training. NIST Computer Security Resource Center

2. Three common implementation approaches

Suppose we want to protect a hospital's medical records.

First: Administrative Controls

For example:

The hospital requires system access to be terminated on an employee's last day of employment.

This is an administrative arrangement.

However, a rule alone is insufficient. Someone must implement it, document the action and confirm that the account has actually been disabled.

Second: Technical Controls

For example:

The hospital's information system checks the role of the person signing in.

Nursing staff may view records needed for their work, but cannot arbitrarily modify physicians' diagnosis records.

This is access control actually enforced through the system.

Scenario clarification | Hospital roles and read/write permissions are fictional teaching examples. Actual permissions depend on duties, care relationships, organizational policy and applicable requirements; these are not universal hospital rules.

Third: Physical Controls

For example:

An access card is required to enter the hospital's server room.

This prevents unauthorized people from directly accessing the equipment.

Notice that these three categories ask “how is the protection implemented?” rather than “what is the protection's purpose?”

3. A second classification: what does the security control actually do?

This is worth mastering for CEH.

First understand three main functions, then add recovery.

1. Preventive

Imagine you are a schoolteacher.

Students can sign in to the learning platform to view grades, but should not be able to change them.

The system therefore implements:

Student
   |
   v
Signs in to the learning platform
   |
   v
Requests a change to their own grade
   |
   v
System checks permissions
   |
   v
No permission to modify grades
   |
   v
Operation denied

This is a preventive control.

Notice two important concepts here.

Authentication

The system checks whether you have passed the identity-verification process.

For example, you enter a password and then authenticate with a security key.

Authorization

The system determines what you may do.

For example, you may view grades but not change them.

These are entirely different.

Even passing MFA, or multifactor authentication, does not mean a user may access all data in the system.

This is a fundamental concept to establish for CEH.

2. Detective

Suppose a student's account attempts to change grades 100 times in one minute.

The system records the operations and notifies an administrator.

This is a detective control.

But pay particular attention to this:

Detecting abnormal activity does not mean the system has stopped it.

For example:

- IDS, or Intrusion Detection System: primarily detects and reports suspicious activity.

- IPS, or Intrusion Prevention System: can detect and block specified activity according to its configuration.

For now, understand the core distinction as:

IDS: detect suspicious behavior → report it

IPS: detect behavior meeting blocking conditions → perform the block

Actual effectiveness still depends on placement, rules and configuration. Installing an IPS does not stop every attack.

3. Corrective

Suppose an administrator discovers that a student-data folder was mistakenly made public.

The administrator restores the correct permissions.

This is a corrective control.

But an important question remains:

What if the data was downloaded before the correction?

Changing permissions cannot automatically erase data that has already been disclosed.

Therefore:

Fixing a weakness does not mean all harm has been eliminated.

4. Recovery

Suppose data on the learning platform has been damaged.

An administrator restores the correct data from a verified backup.

This is a typical recovery control.

But backups involve at least three distinct stages:

Text correction | The original says three stages, but its diagram lists four steps. Read it as four steps; the original attachment is preserved unchanged.

Create a backup
   ↓
Confirm that the backup is protected
   ↓
Actually test restoration
   ↓
Confirm data correctness and normal service operation

Without a restoration test, a backup-completion notification alone cannot establish that the system will recover successfully.

CISA's ransomware guidance also emphasizes offline backups and regular testing, because attackers may try to delete or encrypt accessible backups. CISA

Source verification note | The original CISA PDF returned HTTP 403 on direct retrieval, so no full-PDF reading is claimed. Protected backups and recovery verification can also be checked against CP-9 and CP-10 in NIST SP 800-53 Rev. 5.

5. Are there other control types?

Yes.

For example:

- Deterrent: warnings or visible protective measures reduce the motivation to violate rules.

- Directive: policies, procedures or explicit instructions guide personnel toward appropriate behavior.

- Compensating: when a required control temporarily cannot be implemented, an assessed alternative provides comparable protection.

Different standards may classify controls differently, and one measure can perform multiple functions.

The most reliable exam approach is therefore to judge the actual action described, rather than memorizing product names.

4. Defense in depth: why should failure of one defense not cause complete compromise?

This is the lesson's most important concept.

Build an information system in your mind.

Suppose a university stores student data in its systems.

Place that data at the center and arrange different protections around it.

              External user
                    |
                    v
       +---------------------------+
       | Layer 1: authentication   |
       +---------------------------+
                    |
                    v
       +---------------------------+
       | Layer 2: role permissions |
       +---------------------------+
                    |
                    v
       +---------------------------+
       | Layer 3: data authorization|
       +---------------------------+
                    |
                    v
       +---------------------------+
       | Private student data      |
       +---------------------------+

 Monitoring and alerts: observe activity across layers
 Backups and response: support handling and recovery

This is a simplified teaching model, not a fixed set of layers every real network architecture must follow.

Now simulate a security incident.

Scenario: an employee's authenticated session is abused

Suppose an attacker can already use a customer-service employee's authenticated session.

This means the initial login protection is no longer sufficient on its own to stop this operation.

What happens next?

Step 1: attempt data access

The attacker uses the abused customer-service session to request students' private data.

Step 2: access control takes effect

The system checks:

“May this customer-service account read students' private answers?”

The answer is no.

The system therefore denies this request.

This is where least privilege demonstrates its value.

Least privilege means giving users or programs only the permissions necessary to perform their work, without additional unnecessary privileges. NIST Computer Security Resource Center

Step 3: monitoring raises an alert

The administrator receives a notification:

A customer-service account is attempting to access data outside its permission scope.

This is detection.

Step 4: the administrator handles the incident

After confirming the abnormality, the administrator revokes the affected session and examines other access records.

This is part of correction and incident handling.

Step 5: determine whether recovery is needed

If data was not damaged, there is no need to restore it merely to demonstrate the backup feature.

If the investigation confirms that data was changed, however, further assessment and recovery are needed.

What does this example really demonstrate?

Although the abused session could issue requests, data-access controls still blocked this unauthorized read.

That is the meaning of defense in depth.

But we can say only:

This observed unauthorized read request was denied.

We cannot immediately say:

Absolutely no data disclosure occurred anywhere in the system.

Other times, accounts, data or access paths may not yet have been investigated.

5. Why are three antivirus products not necessarily safer than one?

Transition clarification | The heading asks about antivirus products; the following monitoring-system example illustrates shared blind spots by analogy, not a measured conclusion about particular antivirus products or installation counts.

This is an easily overlooked issue when learning defense in depth.

Suppose a company installs three monitoring systems.

All three, however, depend on the same incomplete logs.

If some operations are not recorded at all:

                  Actual abnormal behavior
                            |
                            v
                   Not recorded in the logs
                            |
              +-------------+-------------+
              v             v             v
          Monitor A     Monitor B     Monitor C
              |             |             |
              v             v             v
          Not observed  Not observed  Not observed

The problem is not a shortage of monitoring tools. All three tools share the same blind spot.

This is a typical case of common-mode failure.

Multiple protections may fail together because they share the same weakness or dependency.

Therefore:

Good defense in depth must consider the independence of controls, not just their number.

Backups provide another example.

If the same compromised administrator account can delete both production data and backups, the backups may be destroyed too.

Possible improvements include appropriate separation of backups from production, restricted deletion permissions and retention mechanisms that prevent arbitrary modification of backups.

6. Five judgments worth mastering for the CEH exam

There are two easily confused traps.

Trap 1: a product can belong to only one control type.

Incorrect.

A security product may combine detection, alerts and automatic blocking.

Judge the action described in the question.

Trap 2: MFA guarantees that accounts and data are safe.

Incorrect.

MFA can reduce certain risks of unauthorized account sign-in.

However, incidents can still occur if an authenticated session is abused, the system has authorization flaws or a user holds excessive privileges.

Access controls and other protections must therefore continue beyond login.

7. How does a security engineer verify that protections actually work?

You cannot ask only:

“Did the company buy a firewall?”

You must also ask:

“Are the firewall rules correct?”

“Does it actually block traffic that should not pass?”

“Does it also block legitimate services?”

NIST SP 800-53A organizes control assessment into three important methods: Examine, Interview and Test. NIST Computer Security Resource Center

Use the learning platform for a simple experiment.

Suppose there are two test accounts:

- teacher_test: has teaching-staff permissions.

- student_test: has ordinary student permissions.

Use fictional grade data in an authorized, isolated test environment.

If every test meets expectations, what can we conclude?

We can say:

“The security controls behaved as expected in these specified test scenarios.”

But we cannot yet say:

“The entire system contains no security vulnerabilities.”

Testing still has scope limitations.

This is an important professional judgment in security engineering: make a conclusion only as broad as the evidence supports.

8. Connect M01-01 through M01-06

Now integrate the six lessons into one line of reasoning.

Think of a security engineer's work as a complete process:

Identify the assets to protect
             ↓
Identify threats and weaknesses
             ↓
Assess risk
             ↓
Obtain authorization and assess the attack surface
             ↓
Analyze possible attack behaviors
             ↓
Design multiple layers of security controls
             ↓
Test control effectiveness
             ↓
Correct weaknesses and monitor continuously

When you reason this way, you are no longer merely memorizing security tools. You understand their roles within the overall defensive architecture.

9. Understanding check: CEH scenario

Answer in your own words; there is no need to recite English terminology.

Scenario:

A hospital system uses MFA for login authentication.

One day, a nurse's already-authenticated session is abused.

The other party attempts to read medical records outside that nurse's care responsibilities.

The system denies the access and records it.

The monitoring system then sends an abnormal-activity alert to an administrator.

The administrator claims:

“We have MFA and monitoring alerts, so we can prove that absolutely no medical records were disclosed. Also, the backup system reports success every day, so we do not need to test restoration at all.”

Answer three questions:

Q1 | Preventive controls

Which actual observation in this case supports the conclusion that “this unauthorized read was blocked,” and why?

Q2 | Detection and evidence

Why can the administrator not claim “absolutely no medical records were disclosed” solely on the basis of MFA and alerts?

Q3 | Recovery controls

Why does a daily backup-success status not prove that service can definitely be restored successfully after a major incident?

These questions check your understanding of prevention, detection, recovery and security evidence interpretation.

Please answer Q1–Q3 first. I will assess each answer against the concepts expected in CEH and provide further teaching where understanding needs reinforcement.

Connections | M01-07 connects controls to risk management and incident response. M09-01 uses human trust to show why training still needs authentication, authorization and reporting processes. These are conceptual links, not a claim that all pages are published.

Q1 | Reveal the reference answer

Q1 | The evidence is that the data-authorization check actually denied this read, supported by a matching result and record. MFA authenticates a login and an alert detects activity; neither substitutes for evidence that this request was blocked. Keep the conclusion limited to the observed request.

Q2 | Reveal the reference answer

Q2 | MFA does not guarantee that an authenticated session cannot be abused. An alert indicates observed suspicious activity, not that every route was blocked. Within authorized scope, check times, accounts, data, other access paths and log completeness. Say that other disclosure has not yet been established, not that none could possibly have occurred.

Q3 | Reveal the reference answer

Q3 | A successful backup notification reports job completion. It does not establish file integrity, freedom from encryption, availability of decryption keys or timely service recovery. Protect backups, test restoration, verify correct data and functioning applications and dependencies, and retain the test evidence.