Alice was working on her major project; she saved all her confidential files and locked her laptop. Bob wanted to access Alice's laptop for his personal use but was unable to access the laptop due to biometric authentication. Which of the following network defense approaches was employed by Alice on her laptop?

The security measure Alice employed, biometric authentication, is a form of access control. Its purpose is to stop an unauthorized event—in this case, Bob accessing the laptop—before it can happen. This aligns directly with the definition of a preventive defense approach. Preventive controls are designed as a first line of defense to block security incidents from occurring. By implementing a lock that requires her unique biological traits, Alice prevented a potential security breach, rather than detecting it as it happened or responding to it afterward.

A. Retrospective approach: This involves analyzing an incident after it has concluded to learn from it (e.g., forensics). Alice's action was to stop the event, not analyze it post-mortem.
C. Reactive approach: This involves responding to an ongoing or just-detected incident (e.g., isolating an infected machine). The biometric lock prevented the incident, it did not react to it.
D. Proactive approach: This involves actively searching for threats and vulnerabilities before they are exploited (e.g., threat hunting). Alice implemented a static defense, not an active threat-seeking measure.

1. NIST Special Publication 800-53 Revision 5, "Security and Privacy Controls for Information Systems and Organizations." In Section 2.3.1, "Control Types," it defines preventive controls as measures that are "intended to prevent security and privacy incidents from occurring." The Access Control (AC) family, which includes authentication mechanisms like biometrics, is a core example of preventive controls.

2. Von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102. This paper discusses the evolution of security paradigms, implicitly defining preventive measures as foundational controls (like access control) that stop unauthorized actions, distinct from reactive (incident response) and proactive (threat intelligence) measures. (DOI: https://doi.org/10.1016/j.cose.2013.04.004, Section 3).

3. Carnegie Mellon University, Software Engineering Institute (SEI). (2017). Common Sense Guide to Mitigating Insider Threats, 5th Edition. Special Report CMU/SEI-2016-SR-013. Practice 4, "Control physical access to facilities and systems," describes physical and logical access controls, such as locks and authentication, as fundamental preventive measures to stop unauthorized individuals from gaining access. (Page 31).