AP Cybersecurity

Implementing Security Controls

Implementing Security Controls

Control objectives are statements of a desired security state. Security controls are specific measures that fulfill the security objectives of an organization.

Security Control Categories

Security controls are categorized based on their mechanism of action: the way that they achieve their objectives. There are four different categories of security control:

  • Technical controls enforce confidentiality, integrity, and availability in the digital space. Examples include firewall rules, access control lists, intrusion prevention systems, and encryption.
  • Operational controls include the processes that we put in place to manage technology in a secure manner. Examples include user access reviews, log monitoring, and vulnerability management.
  • Managerial controls are procedural mechanisms that focus on the mechanics of the risk management process. Examples include periodic risk assessments and security planning exercises.
  • Physical controls are security controls that impact the physical world. Examples include fences, perimeter lighting, locks, fire suppression systems, and burglar alarms.

Security Control Types

CompTIA also divides security into control types, based on their desired effect:

  • Preventive controls intend to stop a security issue before it occurs. Firewalls and encryption are examples of preventive controls.
  • Deterrent controls seek to prevent an attacker from attempting to violate security policies. Vicious guard dogs and barbed wire fences are examples of deterrent controls.
  • Detective controls identify security events that have already occurred. Intrusion detection systems are detective controls.
  • Corrective controls remediate security issues that have already occurred. Restoring backups after a ransomware attack is an example of a corrective control.
  • Compensating controls are controls designed to mitigate the risk associated with exceptions made to a security policy.
  • Directive controls inform employees and others what they should do to achieve security objectives. Policies and procedures are examples of directive controls.

Exam Note: Know the various security control categories and types. The Security+ exam is sure to test your knowledge of them.

10 questions.