Compare and Contrast: Types of Security Controls
1. Security Controls by Function
Control Function
Purpose
Examples
Preventive
Stops an incident before it occurs
Firewalls, MFA, security policies, encryption
Detective
Identifies and alerts on incidents as they IDS,
happen
log monitoring, CCTV, SIEM
Corrective
Mitigates impact and restores operationsBackups,
after detection
patching, system restore
Deterrent
Discourages malicious actions through awareness
Warning banners,
or consequences
training, visible cameras
Compensating
Alternative control when the primary one Manual
isn’t feasible
checks, temporary restrictions
Recovery
Brings systems back to normal after incidents
DRP, redundancy, backups
2. Security Controls by Type / Implementation
Control Type
Description
Examples
Administrative (Managerial)
Policies and procedures that govern security
Security
behavior
policies, risk assessments, training
Technical (Logical)
Technology-based mechanisms to protect
Firewalls,
systemsIDS/IPS,
and dataencryption, ACLs
Physical (Operational)
Protects hardware, facilities, and physicalLocks,
environments
fences, guards, CCTV, mantraps
3. Example Comparisons
Scenario
Control Function
Control Type
Installing an IDS
Detective
Technical
Requiring MFA for login
Preventive
Technical
Posting ‘Authorized Personnel Only’ signs
Deterrent
Physical
Conducting security awareness training
Preventive / Deterrent
Administrative
Implementing backup and restore proceduresCorrective / Recovery
Administrative + Technical