[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 5 · 5.6.b
AP Cybersecurity · Securing Applications and Data
Choosing Data Detection Controls
Two criteria are judgment. The third may be decided for you by law.
key ideaTwo criteria are judgment. The third — classification — may be decided for you by law.
Matching controls to threats
Detective controls for data range from nearly free to expensive, and the choice is not simply ‘buy the best you can afford’. Some classifications carry legal or regulatory detection requirements that settle the question before cost is discussed.
| Criterion | What it asks | What follows |
|---|
| cost | what the control costs to buy and run | honeypots and hash checks are inexpensive; third-party data loss prevention tools are an investment |
| sensitivity or criticality | how attractive the data or application is to an adversary | more sensitive or critical assets are more likely targets and should have stronger detection |
| classification | what category the data fall into | private, educational, healthcare or financial data often carry legal or regulatory detection requirements |
The first two are ordinary risk reasoning. The third can override both — a regulatory requirement is not weighed against budget, it is met.
Cheap and effectivehoneypots, hash checks
Where money goesthird-party DLP
Not optionalregulatory requirements
Layering
Read upward from the bottom. Classification sets the floor, sensitivity sets the ambition, and cost decides how the remaining budget is spent — not the other way round.| Data | Classification | Detection that follows |
|---|
| marketing copy drafts | internal | cheap controls — a honeypot in the share, integrity checks |
| student records | educational | regulatory requirements apply — check what they mandate first |
| patient records | healthcare | regulatory requirements apply; expect logging and alerting obligations |
| card and payment data | financial | regulatory requirements apply; DLP is commonly warranted |
| source code for the flagship product | internal but critical | strong detection on sensitivity grounds alone |
Row 5 shows sensitivity acting without a regulatory prompt. Nothing legally compels stronger detection on source code — its criticality does.
the three criteria
- Honeypots and hash-based integrity checks are inexpensive — there is rarely a cost argument against them.
- Third-party data loss prevention tools are where the real spend is.
- More sensitive or critical data are more likely targets, so they warrant stronger detection.
- Classification can impose legal or regulatory detection requirements that are not optional.
HoneypotA file of fake data that looks valuable and alerts on access — inexpensive to deploy.
Hash integrity checkComparing a stored digest with a recomputed one to detect alteration. Also inexpensive.
Data loss preventionThird-party tooling that watches for data leaving the organization — the expensive option.
Regulatory detection requirementAn obligation attached to private, educational, healthcare or financial data. Not weighed against budget.
Worked analysis
EX 1
Spend the budget
An organization can fund one significant detective control. It holds student records, internal documents, and product source code. Where does it go?
1
Check for regulatory obligations first
Educational data often carry legal or regulatory detection requirements.
2
Note what that does to the decision
Those requirements are met, not weighed — they come out of the budget before any comparison.
3
Assess what remains
Source code is critical and a likely target; internal documents are neither.
4
Allocate
Meet the student-record requirement; spend what remains on detection around the source code.
5
Cover the rest cheaply
Honeypots and hash checks across the internal shares — inexpensive, so there is no reason to omit them.
EX 2
Why cheap controls are not the second-best option
A team assumes honeypots are a stopgap until they can afford DLP. Assess.
1
Note the cost fact
Honeypots and hash checks are inexpensive — the CED lists this as their defining characteristic.
2
Note what they detect
A honeypot catches anyone hunting for valuable data; a hash catches alteration.
3
Note what DLP adds
Coverage across the estate and, in some tools, alerts as an attack is happening.
4
Reject the framing
They detect different things — one is not a cheaper version of the other.
5
Give the recommendation
Deploy both: the cheap controls immediately, and DLP where sensitivity or regulation warrants it.
EX 3
When classification decides
A small clinic's budget cannot cover the detection tooling its data classification requires. What is the correct framing?
1
State the constraint
Healthcare data carry legal or regulatory detection requirements.
2
State what that means
The requirement is not a risk to be accepted — it is an obligation.
3
Reject the usual trade-off
‘Too expensive’ is not an available answer where the law specifies the control.
4
Give the realistic options
Reduce the regulated data held, use a compliant managed service, or fund the tooling.
5
State the principle
Regulation removes a decision from the risk register and puts it in the budget.
Check yourself
Which detective controls does the CED describe as inexpensive?
Show answer
Honeypots and using hash values to check data integrity. Some organizations additionally invest in third-party data loss prevention tools.
How does sensitivity or criticality affect the choice?
Show answer
More sensitive or critical data or applications are more likely targets of an adversary and should have stronger detection accordingly.
Which classifications carry legal or regulatory detection requirements?
Show answer
Data classified as private, educational, healthcare or financial often carry legal or regulatory detection and reporting requirements.
Why does classification rank differently from the other two criteria?
Show answer
Cost and sensitivity are judgments an organization makes. A regulatory requirement is an obligation — it sets a floor rather than entering the trade-off.