Which of the following is a compensating control for providing user access to a high-risk website?

A compensating control provides an alternative measure of protection when a

primary security control cannot be fully implemented or is bypassed. In this scenario, if

access to a high-risk website must be granted (meaning a primary control like outright

blocking is not employed), enabling threat prevention features (e.g., Intrusion

Prevention Systems (IPS), advanced anti-malware, content filtering) on the firewall is

an appropriate compensating control. These features actively inspect traffic to and from

the risky site, attempting to identify and mitigate potential threats in real-time, thereby

reducing the risk associated with the allowed access. This aligns with the NIST

definition of a compensating control, which is used in lieu of a recommended control to

provide a comparable level of protection.

· B. Configuring a SIEM tool to capture all web traffic: A Security Information and

Event Management (SIEM) tool is primarily a detective control. It collects and

analyzes log data to identify potential security incidents but doesn't inherently

prevent or mitigate the initial risk of accessing the high-risk website itself.

· C. Setting firewall rules to allow traffic from any port to that destination: This action

would increase security risks significantly by unnecessarily exposing the destination

to potential attacks on various ports, violating the principle of least privilege. It is not a

security control, let alone a compensating one.

· D. Blocking that website on the endpoint protection software: This is a

preventive control. If the website is blocked, access isn't "provided," which

contradicts the question's premise that user access is being given. A compensating

control is needed when the risky action (accessing the site) is allowed.

1. NIST Glossary - Compensating Security Control: Defines a compensating security

control as: "A security control that is employed by an organization in lieu of a

recommended security control (or control enhancement) in a baseline that provides

equivalent or comparable protection for an information system or organization."

o URL: https://csrc.nist.gov/glossary/term/compensating_security_control

2. Microsoft Azure Documentation - Azure Firewall Premium features (IDPS):

Describes Intrusion Detection and Prevention Systems (IDPS) as a threat prevention

feature that monitors for malicious activity and can block it. This exemplifies the type of

"threat prevention features" referred to in option A.

o URL: https://learn.microsoft.com/en-us/azure/firewall/premium-features#idps

o Specific section: "IDPS"

3. Indiana University - Knowledge Base - What are compensating controls?: States,

"Compensating controls are alternative controls designed to accomplish the intent of a

prescribed control that cannot be implemented due to legitimate technical or business

constraints." This supports the context of using a compensating control when a primary

one (like blocking) isn't feasible.

o URL: https://protect.iu.edu/cybersecurity/security-topic/policiesstandards/compensating-controls/index.html