CoreQ Academy1.1 Compare and contrast various types of security controls.
A control is anything that reduces risk. Every control can be described two ways: by its category (who or what implements it) and by its type (what it does about a threat). Being able to label a control both ways is how you spot gaps in a security program.
Categories (how the control is implemented)
- Technical
- Implemented by systems and software: firewalls, encryption, MFA, antivirus, access control lists. Also called logical controls.
- Managerial
- Administrative decisions that direct the program: risk assessments, security policies, planning, vendor reviews. They decide what should happen.
- Operational
- Carried out by people day to day: awareness training, guard patrols, change reviews, backups run by staff. They make the policy actually happen.
- Physical
- Protect the real-world environment: locks, fences, badges, cameras, bollards, lighting.
Control types (what the control does)
- Preventive
- Stops an incident before it happens. Examples: firewall deny rule, door lock, disabling unused accounts.
- Deterrent
- Discourages an attacker without physically stopping them. Examples: warning banners, visible cameras, "guard dog" signs.
- Detective
- Identifies and records an incident that is happening or has happened. Examples: IDS alerts, log review, motion sensors, audits.
- Corrective
- Restores systems after an incident and limits damage. Examples: restoring from backup, reimaging a host, patching after exploitation.
- Compensating
- An alternative control used when the primary control is not possible. Example: network isolation for a legacy system that cannot be patched.
- Directive
- Tells people what to do or not do. Examples: policies, procedures, an "authorized personnel only" sign. Relies on compliance.
One control can fit more than one type. A visible camera deters and detects. Exam-style questions usually ask for the best fit, which is the main purpose described in the scenario.
A hospital cannot patch an old imaging server because the vendor no longer supports it. The team places it on an isolated VLAN with strict firewall rules. Category and type?
Show answer
Technical category, compensating type. The VLAN and firewall rules are implemented in technology, and they substitute for the primary control (patching) that cannot be applied.
Check your understanding
- Restoring a server from a known-good backup after ransomware is which control type?
- A company cannot enable MFA on a legacy app, so it requires access only through a monitored jump server. This is a:
- A login banner warning that activity is monitored and misuse will be prosecuted is primarily:
- Which are detective controls? (choose all)
- An acceptable use policy is an example of a directive control.
- A security awareness training program is best described as which control category?
Original CoreQ Academy material, mapped to objective 1.1 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.