Which of the following would best prevent unauthorized external changes to an organization's data?

The question asks for the best combination of controls to prevent unauthorized external changes to data. A layered security approach using multiple preventive controls is most effective. A firewall acts as the primary perimeter defense, blocking unauthorized network access from external sources. Antivirus software prevents malicious code, often delivered from external vectors, from executing and altering data. Data encryption protects data at rest and in transit; even if an unauthorized party gains access, they cannot make meaningful changes to the data without the decryption key, thus preventing a loss of integrity. This combination provides robust, proactive prevention.

B. Firewall, data encryption, backup procedures. Backup procedures are a corrective control used to restore data after an unauthorized change has occurred, not to prevent it.
C. Antivirus software, firewall, backup procedures. This option includes backup procedures, which are a corrective, not a preventive, control for the initial unauthorized change.
D. Antivirus software, data encryption, change logs. Change logs are a detective control. They record and help identify unauthorized changes after they have happened but do not prevent them.

1. The Institute of Internal Auditors (IIA)

Global Technology Audit Guide (GTAG) 1: Information Technology Controls

2nd Edition (2012).

Page 13

Exhibit 5: Examples of IT Controls: This exhibit explicitly categorizes controls. It lists "Firewalls

" "Malicious code prevention and detection (e.g.

antivirus)

" and "Encryption" under Preventive Controls.

Page 14

Exhibit 5: This section lists "Log management" under Detective Controls and "Backup and recovery" under Corrective Controls. This supports why options including logs and backups are incorrect for a question focused on prevention.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives.

DSS05 Manage Security Services: This objective includes practices like DSS05.02

"Manage the protection against malicious software

" which aligns with antivirus software. It also includes DSS05.03

"Manage network and connectivity security

" which involves implementing firewalls. These are presented as essential preventive security services.

3. National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-53

Revision 5: Security and Privacy Controls for Information Systems and Organizations (2020).

Control SC-7 Boundary Protection (Firewalls): This control family focuses on monitoring and controlling communications at system boundaries to prevent unauthorized external connections. (Section 3.18)

Control SI-3 Malicious Code Protection (Antivirus): This control requires the use of malicious code protection mechanisms to detect and eradicate malicious code. (Section 3.19)

Control SC-28 Protection of Information at Rest (Encryption): This control specifies protecting the confidentiality and integrity of data at rest

often through encryption

which prevents unauthorized modification. (Section 3.18)