3 Understanding Security Controls

Security controls are the safeguards organizations use to reduce risk to acceptable levels while enabling business success. The chapter emphasizes selecting controls that fit the nature and value of each asset, considering vulnerabilities and likelihood of threats, and balancing expected risk reduction against cost and operational impact. Effective programs favor maintainable, centralized solutions that raise the attacker’s cost, protect multiple assets when possible, and minimize human intervention—aligning security measures with real business needs and outcomes.

Controls are grouped by how they work—physical (e.g., locks, cameras, mantraps), technical (e.g., firewalls, encryption, IDS/IPS, antimalware), and administrative (e.g., policies, procedures, training, background checks)—and strong security layers all three. They are also classified by purpose: preventive (stop incidents), detective (identify events), corrective (restore and limit damage), deterrent (discourage attempts), directive (guide behavior), and compensating (alternative measures when primaries are not feasible). A single control may serve multiple functions, and while naming conventions vary across frameworks, understanding these categories and types—and how they intersect—is essential.

Defense-in-depth ties these ideas together by layering complementary controls across the organization: from policies, procedures, and awareness; to physical protections; to perimeter defenses; and down to internal networks and individual hosts. This layered, mutually reinforcing approach ensures that if one safeguard fails, others can prevent, detect, or respond to the incident, building resilience. Mastering how to choose, combine, and maintain controls creates a practical, cost-effective security posture that translates directly to both exam readiness and real-world practice.

Illustration of the categories of security controls with examples

Illustration of the defense-in-depth model

1. The correct answer is A. Requiring authorization before accessing privileged tools is an example of an administrative control, specifically an instance of segregation of duties (SoD), which refers to the division of roles and responsibilities among different people to reduce the risk of potential errors or fraud. The remaining examples are physical controls, not administrative controls.
2. The correct answer is A. An Intrusion detection system (IDS) is a type of technical security control. Bollards, fences and turnstiles control access to physical facilities, and thus are types of physical security controls.
3. The correct answer is B. Security awareness training is an administrative control because it involves educating employees and users about security policies, procedures, and best practices; administrative controls focus on shaping individuals' behaviors and practices to improve overall security.
4. The correct answer is A. Detective controls alert us to security problems by constantly monitoring activity and recording information, so as to take immediate action in the event of a security control failure. Therefore, a movement sensor is considered a detective control, and is complementary to physical controls.
5. The correct answer is A. Preventive controls are security measures that are implemented to deter cyber-attacks by preventing potential threats and reducing vulnerabilities that cyber attackers could exploit.

FAQ