Detective & Preventive Controls

Bundled into the existing Certified Information Systems Security Professional premium course — no separate purchase.

Included in this chapter:

Firewall type	OSI layer inspected	What it examines	Stateful?	Primary use
Packet-filtering	Layer 3–4 (network/transport)	Source/dest IP, port, protocol flags in each packet header	No (stateless)	Fast, coarse perimeter ACLs; cannot validate session context
Stateful inspection	Layer 3–4 + connection state	Headers plus a state table of active connections	Yes	Default modern perimeter; permits only return traffic for known sessions
Application proxy / gateway	Layer 7 (application)	Full payload of a specific protocol; terminates and re-originates the connection	Yes	Deep per-protocol inspection and internal-host hiding; slower
Next-generation (NGFW)	Layer 3–7 + identity	Stateful inspection plus application awareness, integrated IPS, user identity	Yes	Consolidated app-aware policy with built-in intrusion prevention
Web application firewall (WAF)	Layer 7 (HTTP/HTTPS only)	HTTP requests/responses for app-attack patterns	Yes (HTTP session)	Protects a web application from SQL injection, XSS, and similar

Cheat sheet

A control's category is the job it does, not its label: preventive stops, detective notices
A firewall can only stop what its inspection layer lets it see
Packet-filtering firewalls are stateless and cannot tell a real reply from a forged one
Stateful inspection tracks connections so it admits only return traffic it saw begin
An application proxy terminates and re-originates the connection at Layer 7, hiding internal hosts
A WAF reads HTTP bodies to block app attacks a network firewall is blind to
A next-generation firewall consolidates app awareness, IPS, and identity into one device
IDS detects and alerts; IPS sits inline and blocks
Allowlisting is default-deny and blocks the unknown; denylisting is default-allow and fails open
Signature-based anti-malware is fast but blind to anything not yet in its database
Heuristic catches variants by structure; behavior-based catches the novel by watching it run
A sandbox contains and observes an unknown; a honeypot lures and studies an attacker
A honeypot may entice but never entrap
You can outsource the security operation to an MSSP, but never the accountability
ML/AI security tools detect by baseline deviation, and can themselves be attacked
Layer preventive and detective controls because no single control suffices

Unlock with Premium — includes all practice exams and the complete study guide.

Cheat sheet