847

B. Control Table for Networks and Telecommunications

The following table presents a summary of preventive, detective, and corrective controls as they
relate to networks and telecommunications. Implementation of these controls would help IS
management in strengthening overall management controls.
Preventive Controls

1. Issue and enforce

policies, procedures, and
standards
2. Use encryption and
digital signature
techniques
3. Implement training
and education plans
4. Establish problem and
change management
system
5. Implement faulttolerance network
design practices
6. Implement resilient network design principles
such as redundant equipment and components;
alternate paths, routes,
nodes, and circuits and
lines; and parallel links
and processors
7. Develop contingency
plans

Detective Controls

1. Test contingency plans

2. Require network line
utilization statistics
3. Implement network
diagnostic tools
4. Provide network testing
capabilities

3. Provide network routing

capabilities

5. Test cables and

connectors prior to
power-up for each node

4. Implement network
monitoring tools

6. Conduct periodic
inventory of network
equipment

5. Establish recovery
mechanisms such as
checkpoints, roll-back,
and roll-forward features
in the database

7. Install physical security

devices
8. Implement logical
security mechanisms

6. Establish recovery
techniques from
computer viruses

9. Implement message
sequence numbers
10. Use checksum
techniques

9. Install quality cables for

LAN network

11. Install computer virus

detection tools

10. Use callback system for

dial-up telephones

12. Log identification and

authentication
mechanisms

12. Establish a separate and

centralized network
control function

1. Update contingency
plans
2. Acquire network
diagnostic data collection
tools with automatic
corrective action

8. Implement network management tools

11. Use handheld password

generators and memory/
smart tokens

Corrective Controls

13. Log changes to access

control information
14. Use hardware and
software inventory
tracking system

2006 ExamMatrix/SRV Professional Publications

CISA Theory Section 40000