5.1.1. Logical Security Controls

Stateful vs. Stateless Inspection:

• Stateless: Examines each packet independently
• Stateful: Tracks connection state; return traffic automatically allowed for established connections
• Next-generation firewall (NGFW): Stateful plus application awareness—identifies applications by their traffic (Layer 7) regardless of port, and typically adds IPS and URL filtering. A basic packet-filtering firewall is stateless and sees only addresses, ports, and protocol.

Control Types (by function): Preventive stops an incident (firewall rule, IPS block); detective identifies and alerts (IDS, log review); corrective restores after an incident (restoring from backup, patching); deterrent discourages an attempt (warning banners, visible cameras).

Encryption:

• Data in transit: TLS secures application sessions (HTTPS is HTTP over TLS); IPsec encrypts IP packets at Layer 3 (site-to-site VPNs); SSH secures remote CLI; SNMPv3 adds authentication and encryption to device management. 802.1X is different—it decides whether a device may use a switch port or SSID at all (see NAC in 5.3.1).
• Data at rest: Disk, volume, and database encryption protect stored data if media is stolen.
• Certificates/PKI: A certificate issued by a trusted CA binds a public key to an identity; a self-signed certificate still encrypts, but clients don't trust it by default.