Security controls are measures that reduce risk and protect organizational assets. A control is defined by two dimensions: its category (how implemented) and its functional type (what it does).
Control Categories
Administrative / Managerial Controls
Governance, oversight, and planning. Defined through policies, procedures, and organizational guidelines.
Examples: security policies, risk management processes, personnel security, security awareness training, compliance audits.
Operational Controls
Implemented mainly by people and processes.
Examples: security guards, incident response procedures, backup procedures, employee awareness training.
Technical Controls (Logical)
Implemented through hardware, software, or firmware.
Examples: firewalls, IDS/IPS, antivirus, encryption, access control lists.
Physical Controls
Protect physical resources, facilities, and personnel.
Examples: locks, CCTV, security guards, fencing, lighting.
Functional Types
| Type | Timing | Purpose |
|---|---|---|
| Preventive | Before attack | Stop incidents before they occur |
| Detective | During attack | Identify and detect unauthorized activity |
| Deterrent | Before attack | Discourage attackers by raising perceived risk |
| Corrective | After attack | Fix issues and prevent recurrence |
| Recovery | After attack | Restore systems and operations |
| Directive | Ongoing | Tell users what they must do |
| Compensating | Anytime | Alternative when primary control is not feasible |
Control Matrix
| Preventive | Detective | Deterrent | Corrective | Recovery | |
|---|---|---|---|---|---|
| Administrative | Separation of duties | Periodic access reviews | Security policies | Employee discipline | Disaster recovery plan |
| Technical | Firewall | IDS | Acceptable use banners | Vulnerability patches | Data backup |
| Physical | Walls, fences, gates | CCTV | Warning signs | Fire suppression | Recovery site |
Key Points
- Controls must be cost-effective — the benefit must outweigh the cost.
- A single control can serve multiple functions. A surveillance camera is simultaneously deterrent (visible presence), detective (monitored feed), and compensating (fills a gap elsewhere).
- Relying heavily on one category while neglecting others creates vulnerabilities. Strong technical controls with weak physical controls still leave exposed systems.
- Use a layered combination across categories and functional types.
Compensating Controls
Used when the original control is not practical to implement. Must:
- Meet the intent of the original requirement
- Provide a similar level of security
- Go beyond other existing controls
- Address the additional risk created by not implementing the original
Example: a legacy system that cannot be patched → network segmentation reduces its exposure as a compensating control.
Security Roles
| Role | Responsibility |
|---|---|
| CIO | Overall IT strategy and governance |
| CISO | Security governance, risk management, cybersecurity strategy |
| ISSO | Technical implementation — monitoring, applying controls, access management |
| SOC | Continuous monitoring, threat detection, incident response |
| Managers | Security within their specific domain (finance, web, facilities) |
| Employees | Following policies, reporting incidents, security awareness |
DevSecOps
Security integrated throughout the development lifecycle rather than added at the end.
Traditional: Dev → Ops → Security (end)
DevSecOps: Dev ↔ Ops ↔ Security (every stage)
"Shift left" means security decisions happen at design and requirements — when they are cheap to fix — not at deployment.