Security Control Types and Functions: The Table Security+ Keeps Testing

Security controls are classified on two independent axes, and exam questions almost always ask you to place a control on both. The type is what kind of thing the control is. The function is what it does relative to an incident. A single control has one of each, and the same control can have different functions depending on how it is used.

The four types

Technical controls are implemented in hardware, software or firmware — firewalls, encryption, access control lists, antimalware, authentication systems, logging. Sometimes called logical controls.

Managerial controls are administrative decisions about how security is governed — policies, risk assessments, security planning, vendor assessments, the change management process. Sometimes called administrative controls.

Operational controls are executed by people as part of daily work — awareness training, incident response procedures, guards, configuration management activity, backup operations. The distinction from managerial is that managerial controls decide and operational controls do.

Physical controls act on the physical world — locks, fences, lighting, badge readers, cameras, bollards, mantraps.

The six functions

Preventive controls stop an incident from occurring. A firewall blocking traffic, encryption making data unreadable, a lock keeping someone out, a policy prohibiting an action.

Detective controls identify that an incident occurred or is occurring. Log review, intrusion detection, camera recording, audits, alarm systems.

Corrective controls restore the environment after an incident. Restoring from backup, patching the exploited flaw, rebuilding a compromised host, the incident response procedure itself.

Deterrent controls discourage an attempt without physically preventing it. Warning signage, visible cameras, published sanctions, a login banner. A deterrent works on the attacker's decision-making, which is why a visible camera is deterrent and the recording it makes is detective.

Compensating controls provide an alternative when the primary control cannot be implemented. If a legacy system cannot support multi-factor authentication, restricting it to a segmented network with enhanced monitoring compensates for the missing control. Compensating controls should provide comparable protection and are documented as part of a risk acceptance.

Directive controls instruct people toward correct behaviour — procedures, guidelines, signage telling staff what to do. Not always listed separately, and worth recognizing when it is.

Combining the two axes

This is what the exam actually asks. Some worked examples:

A firewall is technical preventive. Its logs, reviewed for anomalies, are technical detective.

A security policy is managerial preventive or directive. A risk assessment is managerial and, since it identifies weaknesses before harm, preventive in effect.

Security awareness training is operational preventive. An incident response procedure is operational corrective. A guard patrol is operational detective, while the guard stopping someone at a door is preventive.

A door lock is physical preventive. A camera is physical detective when recording and physical deterrent when visible — the same device, two functions, which is a favourite exam trick. A fence is preventive and deterrent together; a warning sign on that fence is purely deterrent.

Backups are technical corrective: they do nothing to prevent an incident and everything to recover from one, and how much they recover is set by the targets under RPO and RTO.

Why the classification matters in practice

Mapping your controls across both axes exposes imbalance, and the imbalance is usually the same: heavy on technical preventive, thin on detective and corrective. An organization with excellent firewalls, no meaningful log review and untested backups has bought one column of the table.

Prevention fails eventually, so detection determines how long an intrusion runs and correction determines how long recovery takes. That balance is the argument behind defence in depth, and it is why the kill chain framing — controls at every stage, not just the first — is useful for finding the gaps.

Compensating controls deserve particular attention because they are where real environments live. Something always cannot be patched, cannot support modern authentication, or cannot be taken offline. Documenting the compensating control and the accepted residual risk, with an owner and a review date, is the difference between a managed exception and an undocumented hole — the same discipline as the exception handling under STIG remediation.

Exam angles

Know the four types — technical, managerial, operational, physical — and the functions: preventive, detective, corrective, deterrent, compensating, directive. Be able to classify a given control on both axes, and recognize that one control may serve different functions in different uses. Know compensating controls as the documented alternative when a required control is not feasible, and expect scenarios where the correct answer is a detective or corrective control because prevention has already failed.