Theory: How to Approach These
In this activity you are given four policy statements and must, for each one, choose a control, classify it, and defend it with a design principle. Work each row in this order:
- Read the statement and find its key requirement. Each statement asks for something different: prevent the printout being left (A), restrict who may take it (B), remove it in time (C), prove who took it (D). The requirement points to the function you need.
- Choose a specific control: a real tool, process or physical measure, not a restated policy line (see 5.1, “What Is a Security Control?”).
- Classify it on both axes: Function (Preventive / Detective / Corrective / Deterrent) and Nature (Administrative / Technical / Physical) (see 5.1).
- Pick the principle that genuinely explains the choice: Defense in Depth, Least Privilege, Fail-Safe Defaults, or Separation of Duties (see 5.2).
- Write one sentence: “why this, and not something else?” Use the principle, don’t just name it (see 5.2, “Use the Principle; Don’t Just Name It”).
Quick scoring checklist. Before you finalize a row, check:
- Is the control specific (a real tool, process, or physical measure), not just a restated policy line?
- Does the Function / Nature classification make sense for that control?
- Does the justification actually use the chosen design principle, rather than just naming it?
- Could this control realistically be implemented at a hospital with a small IT team?
- Would this control still make sense if explained to a non-technical manager?
The Case
MediCare Plus Hospital is a 200-bed private hospital with roughly 800 staff and an IT department of only three people. Its risk register contains this entry:
Risk: printed lab results are left unattended on shared printers, where any passing staff member, patient, or visitor could read confidential patient information.
In Week 4 the hospital drafted policy to address the risk. Four policy statements came out of that work:
| # | Policy statement |
|---|
| A | Printed lab results must not remain unattended at shared printer stations. |
| B | Only the authorized clinician who ordered the test may retrieve the printed lab result. |
| C | Any printed lab result left uncollected must be identified and removed from the printer within a defined time limit. |
| D | The hospital must be able to verify who retrieved a given printed lab result. |
Your task: for each statement, fill in a Control Selection Matrix row: the control you chose, its Function, its Nature, the Secure Design Principle that best justifies it, and a one-sentence justification.
Case Questions & Model Answers
The model answers below are strong answers, but not the only correct ones. Alternatives that also pass the checklist are given after each.
Exercise A
Statement A: Printed lab results must not remain unattended at shared printer stations.
Choose a control, classify it, name the design principle, and justify it in one sentence.
Show solution ↓Hide solution ↑
Solution
Key requirement: the printout should never be sitting in the tray in the first place, so we need a preventive control.
| Control | Function | Nature | Principle |
|---|
| Follow-me / pull printing (badge release): jobs wait in a queue and print only when the sender badges in at the printer | Preventive | Technical | Fail-Safe Defaults |
Justification: “An unclaimed job simply never prints, so the safe outcome (no paper in the tray) happens automatically, even if the clinician forgets or is called away.”
Why Fail-Safe Defaults: the default state, when nobody acts, is “nothing printed,” which is exactly the condition the statement requires.
Other valid answers: moving printers into a staff-only, badge-access room (Preventive, Physical, Least Privilege), but this only limits who passes the tray and costs a room in every ward.
Exercise B
Statement B: Only the authorized clinician who ordered the test may retrieve the printed lab result.
Choose a control, classify it, name the design principle, and justify it in one sentence.
Show solution ↓Hide solution ↑
Solution
Key requirement: restrict retrieval to one specific person, the ordering clinician. That is an access restriction, so it is preventive, and the principle that limits access to exactly who needs it is Least Privilege.
| Control | Function | Nature | Principle |
|---|
| Badge-tied release, matched to the job owner: the printer releases a job only to the badge of the user who sent it (the ordering clinician) | Preventive | Technical | Least Privilege |
Justification: “Only the person who ordered the test, and who badges in, can release the job, so no other staff member, patient or visitor can obtain that result.”
Why not just follow-me printing again? For A, any release mechanism that prevents unattended paper works. For B, the configuration matters: release must be tied to the specific job owner, not to “any staff badge.”
Other valid answers: a sealed envelope collected at a staffed lab counter after an ID check (Preventive, Administrative, Least Privilege), which is workable but slower and relies on staff consistently checking IDs.
Exercise C
Statement C: Any printed lab result left uncollected must be identified and removed from the printer within a defined time limit.
Choose a control, classify it, name the design principle, and justify it in one sentence.
Show solution ↓Hide solution ↑
Solution
Key requirement: something has gone wrong (a result is uncollected) and must be fixed within a time limit. Fixing after the fact is corrective.
| Control | Function | Nature | Principle |
|---|
| Automatic job purge after 60 seconds if unclaimed | Corrective | Technical | Fail-Safe Defaults |
Justification: “The system enforces the time limit automatically, removing the uncollected job without relying on any staff member’s memory.”
Why Fail-Safe Defaults: if nobody acts, the result falls back to the safe state (purged), rather than the unsafe one (waiting to be printed or picked up by someone else).
Other valid answers: a supervisor’s walk-through of printer trays at set intervals, collecting and securely shredding uncollected printouts (Detective + Corrective, Administrative, Defense in Depth). It works even for printers without pull printing, but depends on people and is only as frequent as the walk-throughs.
Exercise D
Statement D: The hospital must be able to verify who retrieved a given printed lab result.
Choose a control, classify it, name the design principle, and justify it in one sentence.
Show solution ↓Hide solution ↑
Solution
Key requirement: evidence of who took the printout, available afterwards. A control that records what happened is detective.
| Control | Function | Nature | Principle |
|---|
| Badge-release audit log recording who released which job, and when | Detective | Technical | Defense in Depth |
Justification: “The log adds an accountability layer on top of the preventive release control, so if a result is misused we can still identify who retrieved it, which supports audits and incident review.”
Why Defense in Depth: the preventive controls in A–C could still fail (e.g. a clinician releases a job and leaves it on a desk). The log is a second, different layer that still works when prevention does not.
Other valid answers: a paper sign-out sheet at a staffed collection point (Detective, Administrative). It is cheaper but easily skipped or falsified, so it scores lower on reliability.
Exercise Debrief
Different groups chose different controls for the same policy statement, and many of them were marked as valid. Why is this normal in security management, and what makes one answer better than another? Summarize the model Control Selection Matrix.
Show solution ↓Hide solution ↑
Solution
Why several controls can be valid. A policy states what must happen; it does not dictate how. Many controls can enforce the same requirement, as 5.1 showed with three different controls for the same printer policy. Which one is “best” depends on the organization’s cost, feasibility, and existing systems (a hospital with a three-person IT team may prefer a simple purge setting over a new building layout). There is rarely one single correct control.
What separates answers. There is a well-justified control and a poorly justified one. A strong answer:
- names a specific control, not a restated policy;
- classifies it sensibly on both axes;
- uses the principle to explain why this control fits, rather than just naming it;
- is realistic for a small IT team and understandable to a non-technical manager.
Model matrix (summary):
| # | Control | Function / Nature | Principle |
|---|
| A | Follow-me / pull printing (badge release) | Preventive / Technical | Fail-Safe Defaults |
| B | Badge-tied release matched to the job owner | Preventive / Technical | Least Privilege |
| C | Automatic job purge after 60 seconds if unclaimed | Corrective / Technical | Fail-Safe Defaults |
| D | Badge-release audit log (who, what, when) | Detective / Technical | Defense in Depth |
The skill being practised is not just picking a control, but being able to defend it. The chosen controls also lead naturally to a Standard (see 5.2): “All clinical printers must use badge-release printing; the badge must be presented within 60 seconds or the job is purged.”