It is considered to be a 'Physical Control'

There are three broad categories of access control: administrative, technical, and physical. Each

category has different access control mechanisms that can be carried out manually or

automatically. All of these access control mechanisms should work in concert with each other to

protect an infrastructure and its data.

Each category of access control has several components that fall within it, a partial list is shown

here. Not all controls fall into a single category, many of the controls will be in two or more

categories. Below you have an example with backups where it is in all three categories:

Administrative Controls

Policy and procedures

- A backup policy would be in place

Personnel controls

Supervisory structure

Security-awareness training

Testing

Physical Controls

Network segregation

Perimeter security

Computer controls

Work area separation

Data backups (actual storage of the media, i:e Offsite Storage Facility)

Cabling

Technical Controls

System access

Network architecture

Network access

Encryption and protocols

Control zone

Auditing

Backup (Actual software doing the backups)

The following answers are incorrect :

Password and resource management is considered to be a logical or technical control.

Identification and authentication methods is considered to be a logical or technical control.

Intrusion Detection Systems is considered to be a logical or technical control.

Reference : Shon Harris , AIO v3 , Chapter - 4 : Access Control , Page : 180 - 185

Which of the following is NOT a technical control?

Trending Exams