Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Network and Endpoint Security Controls
The manager’s view
The security manager doesn’t configure firewalls. They make sure the right network and endpoint controls exist, cover everything they should, have owners and are measured. CISA covers the technical detail; CISM focuses on choosing, governing and evaluating the controls.
Core controls
| Area | Controls |
|---|---|
| Network | Firewalls and segmentation; secure remote access (VPN or zero-trust network access); IDS/IPS; email and web filtering; DDoS protection |
| Endpoint | EDR or anti-malware; hardening to baselines; full-disk encryption; no local admin rights; application control; mobile device management |
Segmentation limits damage
A perimeter firewall doesn’t stop an attacker who’s already inside. Segmentation divides the network into zones with filtering between them, so a compromised laptop can’t reach the payment systems or the backup servers. It’s one of the most effective controls against ransomware spreading.
What each stops
| Control | Main threat addressed |
|---|---|
| Email filtering | Phishing and malicious attachments |
| EDR | Malware, ransomware and attacker activity on hosts |
| Segmentation | Lateral movement after a breach |
| Secure remote access with MFA | Credential theft and attacks on remote access |
| Full-disk encryption | Data loss from lost or stolen devices |
| DDoS protection | Outages from traffic floods |
EDR (endpoint detection and response) looks for malicious behaviour, not just known signatures, so it catches new malware that signature-based antivirus misses.
Measuring coverage and effect
Coverage gaps are the main weakness: an unmanaged device or an unsegmented network undoes the rest. Track:
- % of endpoints with healthy EDR
- % of laptops encrypted
- critical systems in segmented zones
- users with local admin rights
- mean time to contain detected endpoint threats
Example. EDR is reported as “deployed”. A coverage check against the asset inventory finds 15% of servers missing the agent, including the backup server. Ransomware actors target backup servers first, so those gaps are closed within a week.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Control that limits lateral movement | Network segmentation |
| Endpoint tool that detects malicious behaviour | EDR |
| Best control for data on lost laptops | Full-disk encryption |
| Main weakness of endpoint programs | Incomplete coverage |
| Best measure of endpoint control | Coverage against the asset inventory |
In short
- Network controls include firewalls and segmentation, secure remote access, intrusion detection and prevention, email and web filtering, and DDoS protection.
- Segmentation limits how far an attacker can move; critical systems sit in their own zones.
- Endpoint controls include EDR, hardening to baselines, full-disk encryption, no local admin rights, application control and mobile device management.
- EDR detects and responds to malicious behaviour, not just known malware signatures.
- Coverage gaps are the main weakness: an unmanaged device or unsegmented network undoes the rest.
- Managers track coverage and effectiveness metrics, such as EDR coverage, critical-system segmentation and encrypted laptops.
Exam traps
- A firewall at the perimeter doesn't stop an attacker who is already inside; segmentation does.
- Signature-based antivirus alone misses new malware.
- Users with local admin rights can disable endpoint protection.
- Controls that cover 90% of devices leave the attacker the other 10%.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Core controls
Segmentation limits damage