Compare and contrast various types of security controls
Sort controls by category (technical, managerial, operational, physical) and by type (preventive, deterrent, detective, corrective, compensating, directive).
- Reading time
- 18 min read
- Flashcards
- 25 cards
- Practice questions
- 12 questions · 4 PBQs
Almost everything in security is a control: something you put in place to reduce risk. A firewall is a control. So is a policy nobody reads, a guard at a door, and the training video you clicked through last quarter.
CompTIA wants you to classify any control on two axes at once. Most people learn one axis, get asked about the other, and lose marks on questions they actually understood. So the first thing to fix is the confusion between them.
Two axes, not one list
There is no single list of control kinds. There are two questions you ask about every control, and they are independent:
Category — who implements it
- Technical — enforced by hardware, software, firmware
- Managerial — planning and oversight decisions
- Operational — people, executing day to day
- Physical — acts on the real world
Type — what it does about an incident
- Directive — instructs desired behaviour
- Deterrent — discourages the attempt
- Preventive — blocks the action
- Detective — identifies it happened
- Corrective — restores normal operation
- Compensating — substitutes for an unavailable control
The tellCategory asks WHO or WHAT carries it out. Type asks WHEN it acts and WHAT it does. Every control has exactly one of each.
A firewall is technical and preventive. A guard checking badges is physical and preventive. An analyst reading logs is operational and detective. Naming only one axis is half an answer.
Check yourself
Encryption of data at rest is which category and type?
Category: who or what carries it out
The trap here is answering with what the control accomplishes. Category only cares about the implementer.
Technical
Technology enforces it, with no human required in the moment. Firewalls, encryption, antivirus, access control lists, automatic screen locks, MFA systems.
Managerial
Sometimes called administrative. These are the planning and oversight activities — how the organisation decides to manage risk. Risk assessments, written policies, change management procedures, vendor due diligence.
Operational
A person carries it out as part of running the business, day to day. Security awareness training, an analyst reviewing alerts each shift, guards escorting visitors, executing an incident response plan.
Physical
It acts on the physical world to limit real-world access. Fences, bollards, locks, badge readers, lighting, mantraps.
The managerial/operational split catches people out. Use this: writing the plan is managerial; doing the thing is operational. An incident response policy is managerial. An analyst following it at 2am is operational.
Check yourself
A company runs a quarterly risk assessment of its cloud vendors. Which category?
Type: what it does, and when
Order these by when they act relative to an incident and most questions solve themselves.
Before it happens. Directive controls instruct: an acceptable use policy tells you what you may do. Deterrent controls discourage: a sign warning of monitoring changes an attacker's mind, but stops nobody who ignores it. Preventive controls block: a firewall rule drops the traffic whatever anyone intends.
While it happens. Detective controls identify. An IDS alerts, a SIEM correlates, an audit finds the discrepancy. Critically, detective controls do not stop anything.
After it happens. Corrective controls restore normal operation — restoring from backup, patching the exploited hole, reimaging the host.
Any time, as a substitute. Compensating controls stand in for a control you cannot implement.
The two pairs that cost the most marks
Deterrent
- Changes the attacker's decision
- Stops nobody who proceeds anyway
- Warning banner, visible camera, published penalties
Preventive
- Blocks the action itself
- Works regardless of intent
- Locked door, firewall rule, encryption
The tellAsk: if the attacker ignores it entirely, does the attack still fail? If yes, it is preventive. If it succeeds, it was only deterrent.
Detective
- Notices that something happened
- Produces an alert, a log, a finding
- IDS, SIEM rule, audit, log review
Corrective
- Fixes what the incident broke
- Acts after damage is done
- Restore from backup, patch, reimage
The tellThe SIEM alert telling you ransomware ran is detective. Restoring the encrypted files is corrective. Same incident, different controls.
Check yourself
An IDS observes traffic matching a known exploit signature and raises an alert. The traffic is not blocked. Which type?
Compensating controls, and the phrase that gives them away
A compensating control is what you use when the control you actually wanted cannot be implemented.
A legacy medical device cannot support MFA. You cannot fix that — the vendor is gone and the OS is frozen. So you isolate the device on its own VLAN with strict ACLs and heavy logging. That package is a compensating control: it covers the same risk by another route.
Note what compensating is not. It is not "a backup plan" and not "a temporary fix". A corrective control also happens after something goes wrong — the difference is that corrective responds to an incident, while compensating substitutes for a control you could not deploy.
Check yourself
A retailer cannot patch its point-of-sale terminals before an audit, so it segments them onto a restricted network with daily log review. What should it call these measures to the auditor?
When the same object has two answers
Some controls change classification depending on how the scenario uses them. This is intentional on CompTIA's part, and it is not a trick if you read for purpose.
A security camera is deterrent when it is visible and the stated goal is discouraging people. It is detective when footage gets reviewed to work out what happened. The camera did not change; the sentence describing it did.
A security guard is physical when standing at a door controlling entry, and operational when performing a daily procedure like checking logs or escorting visitors.
Putting it together
For any control in a question, run this:
- Who or what carries it out? Technology → technical. Planning or oversight → managerial. A person doing their job → operational. The physical world → physical.
- Does the stem describe an inability? If yes, it is compensating and you are done.
- When does it act? Before → directive, deterrent, or preventive. During → detective. After → corrective.
- Before-narrowing: instructs → directive. Discourages → deterrent. Blocks → preventive.