Security Control Types

Question 1

What is a Security Control Type?

Answer 1

The goal or the function of a particular procedure.

What is it trying to accomplish?

Question 2

Preventative Controls

Answer 2

Controls which seek to stop security incidents from occurring in the first place.

-Encryption
-App Filtering
-Access Control Systems

Question 3

Deterrent Controls

Answer 3

Controls which seek to discourage or deter, make people think twice about what they’re doing.

-Signage (“Restricted Area”)
-CCTV \ Cameras
-Guards

Question 4

Detective Controls

Answer 4

Controls which seek to record and log actions and changes within a given environment

-CCTV / Cameras
-IPS / IDS
-SIEM

Question 5

Corrective Controls

Answer 5

Controls which make it simple to correct errors and mistakes

-Backup / Restore
-IRP (Incident Response Plan)
-DRP (Disaster Recovery Plan)

Question 6

Compensating Controls

Answer 6

Controls which compensate for unavoidable breaches in security posture (A windows 98 system is critical to the business and must be accessible on the network despite being insecure)

Building security “around” rather than “within”

-Segmentation
-Virtualization

Question 7

Recovery Controls

Answer 7

Controls which assist with returning to normalcy after an incident

-Backup/Restore
-DRP (Disaster Recovery Plan)
-BCP (Business Continuity Plan)

Question 8

Directive Controls

Answer 8

Controls which are mandatory procedures, often passed down from C-Suites, Security Teams, or federal regulation (HIPPA)

-AUP (Authorized Use Policy)
-Password Policy
-Data Classification Policy