Which of the following is an example of a preventive control in computer operations?

A preventive control is a security measure designed to proactively stop an undesirable event or security incident from occurring. A firewall is a prime example of this, as its core function is to inspect and filter network traffic based on a set of security rules. By blocking unauthorized or malicious traffic before it can reach internal systems, the firewall actively prevents potential intrusions, malware infections, and other network-based attacks, thus fulfilling the definition of a preventive control.

A. Backup and recovery procedures: These are corrective controls, as they are used to restore systems and data to a normal state after a failure or data loss incident has already happened.

C. Incident response planning: This is a corrective and responsive control framework that guides actions during and after a security incident to manage and mitigate its impact.

D. Penetration testing: This is a detective control. Its purpose is to actively search for and identify existing vulnerabilities, not to prevent an initial incident from occurring.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (Special Publication 800-53, Revision 5).

Reference: Section 2.2, "Control and Control Enhancements," discusses the nature of controls. Controls within families like Access Control (AC) and System and Communications Protection (SC), where firewalls are implemented (e.g., SC-7), are fundamentally preventive as they are "intended to avoid an event from occurring."

2. Santos, O., & Stuppi, J. (2020). CCNA CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press.

Reference: Chapter 1, "The Danger," in the section "Security Controls," explicitly categorizes firewalls and access control lists (ACLs) as technical, preventive controls. The text contrasts this with detective controls (like IDS) and corrective controls (like backups).

3. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 18(7), 38-42.

Reference: This foundational academic paper on computer security outlines design principles. Principle of Least Privilege (Section I.A.3), which is enforced by mechanisms like firewalls, is described as a preventive measure to limit the "potential for harm" before it happens. (DOI: https://doi.org/10.1145/361011.361062)