Lesson 8 — Controls, Monitoring, Auditability & Tools
Data-centric controls
Chapter 7 repeatedly brings control close to the data itself:
- database views exposing approved rows/columns;
- row/column restrictions for granular entitlements;
- masking for protected displays or non-production copies;
- encryption where required;
- Metadata classifications driving consistent rules;
- identity management for role membership/grant/revocation;
- IDS/IPS and activity monitoring;
- network firewalls as one layer—not a complete data-security solution;
- prompt security patching;
- document sanitization before sharing.
A firewall can filter traffic and still fail to prevent an authorized application/user from misusing data. That is why the chapter is data-centric, not just perimeter-centric.
Active monitoring vs Passive monitoring vs Audit
Active monitoring
Detects and may alert/interrupt suspicious behavior in near real time.
Clue: alert/block now.
Passive monitoring
Takes periodic snapshots, trends, or configuration comparisons against benchmarks.
Clue: weekly/monthly trend review.
Audit
Independently evaluates controls, logs, actions, and evidence against policy, standards, regulation, or other criteria.
Clue: independent assurance.
A DBA may monitor database activity. That does not make the DBA’s operational review an independent formal audit of the control the DBA operates.
Audit trail = proof, not intent
A policy saying “complete privacy training before PII access” is not enough. The organization needs evidence tying the employee’s training completion to the authorization decision.
A strong chain is:
Policy → Standard → Control/Procedure → Log/Evidence → Independent Audit → Findings/Improvement
Tools and techniques to recognize
Tools: anti-virus/security software, web-page security, IAM, IDS/IPS, firewalls, Metadata tracking, masking/encryption.
Techniques: CRUD/CRUDE matrices, immediate patch deployment, security attributes in Metadata, security requirements during project analysis, efficient search of encrypted data, document sanitization.
Document sanitization
Removes hidden/residual information such as comments, tracked-change history, authorship, or embedded sensitive details before external sharing.
Design security in early
Classification, access, logging, masking/encryption, and evidence requirements belong in project analysis/design. Late retrofit is costlier and leaves gaps.
Source anchor: pp. 243–249.