An organization has implemented a policy to detect and remove malicious software from its network. Which of the following actions is focused on correcting rather than preventing attack?

A corrective control is implemented to remediate a problem after it has been detected. In this scenario, Network Access Control (NAC) takes action after a host has been identified as infected with a virus. The act of disabling the host's communication is a corrective measure designed to contain the threat and fix the immediate security issue by isolating the compromised system from the network. This action directly addresses and corrects an existing security failure, which is the core function of a corrective control. The other options are preventive controls, which aim to stop an incident from occurring in the first place.

A. Firewall whitelisting is a preventive control that proactively blocks unauthorized network traffic before an incident occurs.
C. Disabling autorun is a preventive system hardening measure intended to stop malware from executing automatically.
D. User security training is a preventive administrative control designed to stop attacks by educating users to avoid them.

1. NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations. Appendix F, Security Control Structure, defines control types. Corrective controls are described as actions taken to "identify and correct problems" and "reduce the impact of an incident." NAC quarantine falls under this definition. (Page F-2)

2. NIST Special Publication 800-12 Revision 1, An Introduction to Information Security. Section 5.2, "Types of Controls," states, "Corrective controls are used to remedy the circumstances that caused an unwanted event...". The example of isolating an infected system fits this description perfectly, while firewalls and user training are listed as preventive. (Page 33)

3. MIT OpenCourseWare, 6.858 Computer Systems Security, Fall 2014. Lecture 1 notes, "Introduction and Threat Models," differentiate security mechanisms. "Responsive" (or corrective) mechanisms like quarantine are contrasted with "Preventive" mechanisms like firewalls, which aim to stop attacks before they succeed. (Lecture 1 Slides, Slide 20)