Preventive, detective, and corrective controls

Security controls are safeguards designed to reduce specific security risks. Controls are practical and specific. For example, an actual lock on the door or the alarm system installed in the house. Security controls are broadly classified into three main types and categories

• Risk assessment plans
• Access control policies defining principle of least privilege | - Security training programs
• Compliance program enforcement
• User training on access control best practices | - Firewalls
• MFA implementation for employees
• Role-based access controls (RBAC)
• Configured permissions on systems | - Guards monitoring entry points
• Locked server rooms
• Keycard access restricted to necessary areas | | Detective | - Audit policies
• Incident response planning | - Regular log reviews
• Fraud detection programs | - IDS- File integrity monitoring
• High-level technical alert configurations | - Motion sensors actively monitoring spaces
• High-level monitoring policies (e.g., CCTV review requirements) | | Corrective | - Business continuity planning
• Post-incident root cause analysis | - Employee retraining after phishing attacks
• Incident response execution | - Restoring data from backups
• Applying security patches
• Updating technical policies post-incident (e.g., patch mandates) | - Replacing damaged locks
• Repairing cameras
• Physical perimeter update policies |
• Three Types:
  • Technical control types include the many technologies used to protect assets. This includes encryption, authentication systems, and others.
  • Operational controls relate to maintaining the day-to-day security environment. Generally, people perform these controls like awareness training and incident response.
  • Managerial controls are centered around how the other two reduce risk. Examples of management controls include policies, standards, and procedures.
• Security controls should be designed with the principle of least privilege in mind. When they are, they rely on differentiating between data owners and data custodians:
  • A data owner is a person who decides who can access, edit, use, or destroy their information. The idea is very straightforward except in cases where there are multiple owners. For example, the intellectual property of an organization can have multiple data owners
  • A data custodian is anyone or anything that's responsible for the safe handling, transport, and storage of information. Did you notice that I mentioned, "anything?" That's because, aside from people, organizations and their systems are also custodians of people's information