Hi Norm,

Certainly an interesting case to make for CCM software (eg. Virsa).  I would still be concerned as whether the aspects of identification/notification (eg. Detect controls) eliminates the action step of a Prevent control.  Simple example:  A Detect control in place says to identify any A/P check being issued in a value of over $10K (maybe the average value of invoice amounts for this company is $2K?).  Even if this control has a CCM system behind it that identifies such an invoice has been cut for payment, they need to notify someone of the anomoly.  This could be the same person attempting to perpetrate the fraud, if it is an "inside job".  As an alternative, you could also have this Detect control backed up by a Prevent control that states any check over the average $ amount of $2K requires a second signature from someone at the Director of VP level?

The simplistic example I like to  use for explaining Detect, Prevent and Mitigating Controls is this:

A burgler is planning to break into your house and rob  you blind:

1.  Detect Control is security lights and alarm system

2.  Prevent Control is the deadbolt lock on all doors and windows

3.  Mitigating Control is Brutus the pitbull sleeping in the front foyer

I agree there can be a blurring between Detect and Prevent controls, but there is also a distinction, IMO.

Best regards,

Paul Fine

 Hi Norman,

Hope you're well.

I would agree that we are seeing a 'convergence' between detective and preventative controls. I think this does demand a rethink of which controls options are most suitable in some circumstances. Detective controls are not only cheaper in many cases but are often a lot more flexible. 

Ultimately if a detective control is real time, allowing preventative action to be undertaken before any consequences occur then there is little difference in the strength of this control compared to a more traditional preventative control. What I would say though is that the strength of the real time detective control is usually still dependent on human intervention, i.e. someone needs to do something with the alert, exception report, etc... This for me is the key distinction that still remains. 

Best Regards,

Richard

Norm:

I agree with your idea and have for a long time. Prevention controls tend to frustrate people (just think about the traditional purchasing process with a purchase request, purchase order, invoice, receiving report etc. – prevention controls that are costly). When people get frustrated by strong controls, they work to figure out how to get around the control.

Detection controls can allow for new and simplified processes that enable staff to get things done more timely (credit cards to make purchases, for example) and at a significantly lesser cost in many cases. But it also requires a different skill level – data analysis to identify improper credit card payments as opposed to clerical staff to process the paper in a traditional purchasing system.

Too often, I see auditors making recommendations for strong controls – but they are the wrong controls. Auditors staying at the top of their game make recommendations for the right controls.

Dave Hancox

An interesting thought for sure, however there is no 1 right answer. I feel the choice should be based on the risk level based on the impact. If the risk is high and impact is high a preventive control supplemented by some additional mitigation would be sensible. But if the risk level and impact is not too high it doesnt make sense to have expensive preventive controls. So this will have to be decided on a case to case basis..... 

Both controls obviously have their benefits and as you note must also be considered relative to cost-benefit, since preventive controls or more often more costly.  We have also analyze the level at which management actually relies on a given control.  While often more applicable to detective controls, it can be more important than the value of the control itself.  For instance, if we identify a given process, report or edit control as being the key control in mitigating a risk but management ignores that control in general, is it really an effective control?  If these immediate detective controls as you call them are properly applied and key to how the given situation is managed and are less expensive, I think we could make a good argument to implement them in lieu of the preventive control.

It certainly matters if a control is detective or preventive.  Detective and preventive controls are spearate and complimentary, AND absolutlely necessary where appropriate.  Detective controls are generally passive, intended to alert the operator that a control or policy is being breached.  This can be in support of a preventive control, part of an alerting process, or as input into a reporting process.

A preventive control is active, taking action to stop the detected action, defer/compensate for the action, or mitigate the potential impact that allowing the action would incurr.

Preventive controls are viewed as more beneficial, but also carry additional risk.  They generally rely on baselines, and measure deviation from "normal" as an indicator of anomoly.  They can be subject to false-positives, and can interfere with operations.

I don't setup an Intrusion Prevention Systems without first running it in passive Detection mode for some period, and then tweaking each detection rule that reports its indicators reliably over time.  How and when prevetive rules are enabled is a factor of potential impact, risk, and reliability.

Just my 2¢, collect the whole dime!

Mark

Three ideas:

1.- They are different parts of the adaptation cycle.  Detection feeds the prevention.

2.- The Prevention is Detection of a known risk.

3.- The Prevention does not exists. Only exists the Detection.

Conclusion: All controls are about Detection. The Prevention only knows how to handle a known risk.