3 Understanding Security Controls

Organizations use security controls to lower risk to an acceptable level while protecting confidentiality, integrity, and availability. The right controls depend on the asset, its vulnerabilities, the value at stake, and the likelihood and impact of threats. Because controls can be expensive or disruptive, they should be chosen with a cost-benefit mindset so that the protection they provide is worth more than the effort required to implement them.

Security controls are commonly grouped into physical, technical, and administrative categories. Physical controls protect facilities and people through measures like locks, fences, cameras, and badge readers; technical controls protect systems and data through tools such as firewalls, encryption, IDS/IPS, antivirus, MFA, and monitoring systems; administrative controls guide human behavior through policies, procedures, standards, training, background checks, and related management practices. Many technologies can support more than one category, and effective security often combines these controls so that people, process, and technology reinforce one another.

Controls can also be classified by what they do: prevent, detect, correct, deter, direct, or compensate for weaknesses. Preventive controls try to stop incidents before they occur, detective controls identify suspicious activity, corrective controls help restore normal operation, deterrent controls discourage attacks, directive controls guide behavior, and compensating controls provide alternate protection when a primary control is unavailable or insufficient. Together, these control types support defense in depth, a layered strategy in which multiple safeguards are arranged so that if one layer fails, others are still in place to protect the organization.

Illustration of the categories of security controls with examples

Illustration of the defense-in-depth model

1. The correct answer is A. Requiring approval before accessing privileged tools is an example of an administrative control, specifically an instance of segregation of duties (SoD), which refers to the division of roles and responsibilities among different people to reduce the risk of potential errors or fraud. The remaining examples are physical controls, not administrative controls.
2. The correct answer is A. An Intrusion detection system (IDS) is a type of technical security control. Bollards, fences and turnstiles control access to physical facilities, and thus are types of physical security controls.
3. The correct answer is B. Security awareness training is an administrative control because it involves educating employees and users about security policies, procedures, and best practices; administrative controls focus on shaping individuals' behaviors and practices to improve overall security.
4. The correct answer is A. Detective controls alert us to security problems by constantly monitoring activity and recording information, so as to take immediate action in the event of a security control failure.
5. The correct answer is A. Preventive controls are security measures designed to stop threats from successfully exploiting vulnerabilities before damage occurs.

FAQ