Chapter 27 — Information security: control design
Lesson map
Lesson 27 published. Map, example, EX079.
flowchart TD
N0["Learning outcomes"]
N1["27.1 Designing a control"]
N2["27.2 Evidence of operation"]
N3["27.3 Cost and friction"]
N4["27.4 Effectiveness"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX079"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["27.1 Designing a control"]
N2["27.2 Evidence of operation"]
N3["27.3 Cost and friction"]
N4["27.4 Effectiveness"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX079"]
[Learning outcomes]
|
v
[27.1 Designing a control]
|
v
[27.2 Evidence of operation]
|
v
[27.3 Cost and friction]
|
v
[27.4 Effectiveness]
|
v
[Worked example] --> [Exercise EX079]
Learning outcomes
You will (1) design preventive, detective and corrective controls; (2) specify control operation and evidence; (3) assess control cost and effectiveness.
27.1 Designing a control
Lindiwe designs a control for address changes in dispatch, responding to the fraud threat identified earlier. Preventive part: changes to delivery addresses for high-value orders require approval by a second person. Detective part: an alert fires when an address changes within an hour of dispatch. Corrective part: suspicious changes are reversed and the customer contacted. Prof. Hale asks her to specify who operates each part and what evidence shows it ran. She writes the design as a one-page control description with owner, frequency and evidence.
27.2 Evidence of operation
A control that cannot show it ran cannot be audited. Lindiwe specifies evidence: approval records with both names and times, alert logs with handling notes and a monthly sample review by the security lead. She notes that ISO/IEC 27001 expects organisations to monitor and measure their controls, so evidence is not optional. She learns to design evidence collection into the control from the start, rather than reconstructing it before an audit. The security lead agrees to perform the monthly sample review and to record any exceptions found.
27.3 Cost and friction
Second-person approval slows urgent orders. Lindiwe applies the control only to orders above a value threshold, set where the fraud loss would exceed the cost of delay. She estimates that about five percent of orders exceed it. Prof. Hale notes that controls applied universally often get bypassed, while targeted controls remain sustainable. She records the threshold and its reasoning so it can be adjusted as fraud patterns change. The operations manager agrees to the threshold after seeing the estimate, and asks for a review after three months of operation.
27.4 Effectiveness
Lindiwe proposes measuring effectiveness: how many suspicious changes the alert catches, how many approvals are rejected and whether fraud losses fall. She notes that rare events make effectiveness hard to measure quickly, so she will also test the control by staging synthetic suspicious changes and checking that alerts fire. She learns that testing with planted cases gives evidence even when real attacks are too rare to count. She plans to stage one synthetic suspicious change each month and record whether the alert fired and how quickly it was handled.
Worked example
Lindiwe designs a layered address-change control, specifies its evidence, targets it at high-value orders and plans to test it with planted cases.
Synthetic case. Controls are synthetic.
Errors and limits
A control that leaves no evidence cannot be shown to work.
Exercises
- EX079 — Preventive part. What is the preventive part of the address control? Rubric: 3 = second-person approval;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX080 — Targeted share. About what share of orders exceed the threshold? Rubric: 3 = about five percent;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX081 — Planted tests. How is the control tested despite rare fraud? Rubric: 3 = staging synthetic suspicious changes;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 27 (chapter 27 of 50)
← Chapter 26 · Course chapter index · Chapter 28 →
Continue to the next authored lesson.