A timely review of system access audit records would be an example of which of the basic security functions?

Reviewing system access audit records is a classic example of a detective security control. The primary purpose of this activity is to identify security events, policy violations, or unusual activities after they have occurred. The logs provide a record of past events, and their analysis allows security personnel to detect potential or actual security incidents that were not stopped by preventative controls. This function is about discovery and investigation, not prevention or deterrence.

A. avoidance: Avoidance is a risk management strategy that involves eliminating the activity or asset that creates the risk, not monitoring it.

B. deterrence: Deterrence aims to discourage an attacker from attempting an action. While the knowledge of log reviews can be a deterrent, the act of reviewing itself is detective.

C. prevention: Prevention aims to stop an incident from occurring in the first place (e.g., a firewall). Log review is a post-event analysis.

1. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations. The control family AU (Audit and Accountability)

specifically control AU-6 "Audit Record Review

Analysis

and Reporting

" describes the process of reviewing logs to detect "inappropriate or unusual activity." This function is inherently detective in nature. (See Section 2

Control Family AU-6).

2. Purdue University

"Information Security and Privacy

" Types of Controls. The documentation defines detective controls as those "used to detect and report the occurrence of an error

omission or malicious act." It lists "reviewing audit trails and logs" as a specific example of a detective control. (See Section: "Types of Controls

" Subsection: "Detective").

3. University of California

Berkeley

Security Policy

Glossary of Terms. Defines Detective Controls as: "Controls designed to detect

report

and recover from a security breach. Examples include audit trails

intrusion detection systems

and virus detection software." The review of audit trails (records) fits this definition directly. (See "Detective Controls" definition in the glossary).