Detective Controls

Correct Answer: Security Information and Event Management (SIEM) system

The best detective control to facilitate the reconstruction of events after unauthorized access to confidential data is indeed a Security Information and Event Management (SIEM) system. SIEM systems are specifically designed to gather, analyze, and present information from a variety of sources across the IT infrastructure, such as network devices, servers, and security appliances. This enables organizations to quickly spot unusual activities that may indicate security incidents, providing comprehensive logging and real-time analysis for incident response. SIEM systems also aid in the forensic analysis after an event has taken place, helping to understand what happened, how it happened, and who might have been involved. Periodic user access reviews are a preventive control, mainly intended to ensure that only authorized individuals have access to specific resources based on their role or need to know but do not directly provide the detailed activity logging needed to reconstruct events after a breach. Implementation of stronger firewall rules is another preventive control that aims to stop unauthorized access by defining what traffic is allowed or blocked, but it does not inherently log detailed events for reconstruction purposes. Continuous vulnerability scanning is a preventative and monitoring control designed to identify security deficiencies in the IT environment, but by itself, it does not track user actions or system changes that would allow for event reconstruction after a data incident.

Correct Answer: File Integrity Monitoring (FIM)

FIM detects malicious or unauthorized manipulation of files and can help identify the attacked components within the system. The other options do not provide a focused view on files and their integrity.

Correct Answer: Data Loss Prevention (DLP)

Data Loss Prevention (DLP) is the most effective detective control in this scenario. DLP systems are designed to detect and prevent the unauthorized transmission of sensitive information outside the organization's network. In this case, when the employee provided their login credentials in response to a phishing email, a properly configured DLP system would have detected the attempt to transmit sensitive data (login credentials) outside the network. DLP systems can be configured to recognize patterns of sensitive information, including hashed versions of passwords, and can block the transmission while alerting administrators. This would have prevented the unauthorized access to the corporate network by stopping the credentials from leaving the organization in the first place. While other options like UEBA or NIDS might detect unusual behavior after the fact, DLP is proactive in preventing the initial data exfiltration, making it the most effective in this specific scenario.