General Security Concepts · Topic 1 of 7
Security Control Categories and Types
Learn the four Security+ control categories and six control types, with examples, so you can classify any safeguard that a scenario describes.
- 4 min
- There are four categories: technical, managerial, operational and physical.
- There are six types: preventive, deterrent, detective, corrective, compensating and directive.
- A firewall is technical and preventive. An IDS is technical and detective.
What it is
A security control is any safeguard that reduces risk to an organization's people, systems or data.
Security+ sorts controls in two ways. The category says who or what carries the control out: technical, managerial, operational or physical. The type says what the control does about an attack: preventive, deterrent, detective, corrective, compensating or directive.
Every control has a category and at least one type. A firewall is a technical control, and its type is preventive.
How it works
Controls are layered so that when one fails, another catches the problem. This idea is called defense in depth.
The four categories
| Category | Carried out by | Examples |
|---|---|---|
| Technical | Hardware, software or firmware | Firewall, encryption, antivirus, access control lists |
| Managerial | Management, through planning and oversight | Risk assessment, security policy, vulnerability management program |
| Operational | People, through day to day processes | Awareness training, incident response procedures, change handling |
| Physical | Tangible barriers in the real world | Locks, fences, badge readers, cameras |
Managerial controls are sometimes called administrative controls. Operational controls depend on staff following a process, while technical controls work without a person acting each time.
The six types
| Type | Purpose | Examples |
|---|---|---|
| Preventive | Stop an event before it happens | Firewall, lock, least privilege, intrusion prevention system (IPS) |
| Deterrent | Discourage someone from trying | Warning signs, visible cameras, bright lighting |
| Detective | Find an event that is happening or has happened | Log review, intrusion detection system (IDS), motion sensor |
| Corrective | Limit damage and restore normal operation | Restore from backup, apply a patch, quarantine malware |
| Compensating | Stand in when the main control is not possible | Extra monitoring on a system that cannot be patched |
| Directive | Tell people what they must or must not do | Policy, standard, procedure, signed acceptable use rule |
A single control can fit more than one type. A visible security camera deters, and its recording also helps detection.
Reading a scenario
Ask two questions in order. First, what is the control made of: a device or program, a rule or document, a person following a process, or a physical barrier? Second, what does it do in relation to the incident: block it, discourage it, notice it, repair it, replace a missing control or instruct people?
What to remember for the exam
- There are four categories: technical, managerial, operational and physical.
- There are six types: preventive, deterrent, detective, corrective, compensating and directive.
- A firewall is technical and preventive. An IDS is technical and detective.
- A written policy is managerial and directive. Awareness training is operational.
- A lock, fence, bollard or badge reader is a physical control.
- Restoring from backup is corrective because it repairs damage after an event.
- A compensating control is used when the normal control cannot be applied, and it must give similar protection.
- A deterrent works on the person's decision. A preventive control works on the system.
When a question names both a category and a type, answer each one separately and pick the option that fits both.
Common mistakes
Mixing up category and type. "Technical" and "preventive" answer different questions, so an option that offers one where the other is asked is wrong.
Treating detective as preventive. An alert that tells you an attack happened does not stop it, even if people react quickly afterward.
Calling every policy operational. Policies and risk programs set direction and belong to the managerial category. The people who follow the process day to day are operational.
Confusing deterrent and preventive. A sign that says "Authorized staff only" discourages. A locked door actually stops entry.
Using compensating as a word for "backup". A compensating control replaces a control that cannot be used, such as putting a legacy server on an isolated network because it cannot take security updates.
Some controls fit two types. If the question asks for the primary purpose, choose the type that describes the main job of the control.
Check yourself
Which category does a badge reader on a server room door belong to?
Physical, because it is a tangible barrier. Its type is preventive.
A company cannot patch an old industrial controller, so it adds network isolation and extra monitoring. What type of control is this?
Compensating, because it replaces the missing patch control with similar protection.
What is the difference between a detective and a corrective control?
A detective control finds an event, such as an IDS alert. A corrective control repairs the damage, such as restoring from backup.
Topic 1 of 7 in General Security Concepts
Test yourself on General Security Concepts
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.