Security Controls: Categories and Types
Unit 1: Security Foundations. Lesson 1 of 54 in SecPlus Academy.
A security control is anything that reduces risk: a firewall rule, a policy, a guard, a lock. The exam sorts every control two ways at once. The category says who or what applies it. The type says what it is meant to achieve. One control can sit in several cells depending on how it is used, so always answer from the purpose the question describes.
The four categories
- Technical: applied by systems and software. Firewalls, encryption, intrusion detection, access control lists, multifactor authentication.
- Managerial: applied through planning and oversight. Risk assessments, security policies, vendor reviews, audit programs.
- Operational: carried out by people in day-to-day procedures. Security guards, delivering awareness training, running backups, following the incident response steps.
- Physical: protect the building and the hardware. Locks, fences, badges, cameras, lighting, bollards.
The six types
- Preventive: stops the event from happening. A firewall rule, a door lock, least privilege.
- Deterrent: discourages the attempt without physically stopping it. Warning signs, visible cameras, login banners.
- Detective: notices the event during or after. IDS alerts, log review, audits, motion sensors.
- Corrective: repairs the damage. Restoring from backup, patching after a compromise, the recovery steps of incident response.
- Compensating: an alternative that fills in when the ideal control cannot be used. Extra monitoring and isolation for a system that cannot be patched.
- Directive: tells people what they must do. Policies, procedures, an acceptable use agreement, a sign that says "badge in."
One control, several cells
A camera is physical by category. When it is mounted where thieves can see it, it deters. When its footage is reviewed after a theft, it detects. A backup is operational when someone runs it and corrective when it is used to recover. The question tells you the purpose; the purpose picks the type.
How to read the question
- "Which category" wants technical, managerial, operational, or physical.
- "Which type" wants preventive, deterrent, detective, corrective, compensating, or directive.
- "The system cannot be patched, so the team adds..." is compensating.
- "A policy instructs users to..." is directive.
Security Controls: Categories and Types, explained slowly
Two questions about every control
Picture a bank. It has a vault door, a guard, a sign that says "cameras in use," an alarm, an insurance policy, and a rule that two people must open the vault. Every one of those is a security control. The exam sorts them on two axes, and the trick is that the axes are independent: you answer "who applies it" and "what it does" separately.
Axis 1: category (who applies it)
Technical a machine enforces it firewall, encryption, MFA, IDS, ACL Managerial a plan or policy defines it risk assessment, security policy, vendor review Operational a person performs it guard patrol, running backups, training delivery Physical the building enforces it lock, fence, badge reader, bollard, camera
The bank: vault door and bollards are physical; the guard is operational; the two-person rule is managerial; the alarm system is technical.
Axis 2: type (what it does)
Preventive stops it vault door, firewall rule, least privilege Deterrent discourages it "cameras in use" sign, login banner, visible guard Detective notices it alarm, IDS, log review, audit Corrective repairs it restore from backup, incident response, patching after the fact Compensating substitutes extra monitoring where the real fix is impossible Directive instructs people policy, procedure, "badge in" sign
The part that trips people up: one control, many cells
The same camera is:
- Physical by category, always.
- Deterrent if the question says thieves can see it and stay away.
- Detective if the question says footage was reviewed after the theft.
A backup is operational when a technician runs it and corrective when it is used to recover. A policy is managerial by category and directive by type. So never memorize "camera = detective." Memorize the verbs and read the purpose the question describes.
Compensating controls, the exam favorite
A compensating control is what you add because the ideal control cannot be used. The classic: a medical device runs an old operating system that cannot be patched. You cannot fix the vulnerability, so you put the device on its own network segment, block everything except the one server it talks to, and watch its traffic. Those controls compensate for the missing patch. Whenever a question says "cannot be patched," "legacy," or "the vendor does not support," expect compensating.
Worked examples
Scenario Category Type A login banner warns that activity is monitored technical deterrent The company adopts a policy requiring quarterly reviews managerial directive Guards check badges at the lobby operational preventive A file integrity monitor alerts on a changed system file technical detective A server is restored from last night's backup operational corrective Extra logging is added to a system that cannot be patched technical compensating
How the exam asks it
- "Which type of control is a warning sign?" Deterrent.
- "Which category is a risk assessment?" Managerial.
- "The organization cannot patch; what kind of control is the added segmentation?" Compensating.
- "Which control corrects a problem after it occurs?" Corrective.
What to memorize
- Categories: technical, managerial, operational, physical.
- Types: preventive, deterrent, detective, corrective, compensating, directive.
- Read the purpose in the question; the purpose picks the type.