← All lessons
Foundations · Beginner · 5 min
Security controls
Prevent, detect, correct: what each defence is for.
What it is
A control is anything that reduces risk. Controls come in four categories by how they work: technical (enforced by technology, like a firewall or MFA), managerial (decisions and policies, like a risk assessment), operational (things people do, like security awareness training or checking logs) and physical (locks, fences, badges). Each control also has a type, by what it does: preventive controls stop something happening, deterrent controls discourage the attempt, detective controls notice it, corrective controls fix things afterwards, directive controls tell people what to do, and compensating controls stand in when the usual control can't be used. Good defence layers several types, because no single control is perfect.
Real case · 2013
Target
Attackers got in using a heating contractor's stolen login and planted malware on Target's checkout tills, taking about 40 million payment card numbers. Bloomberg Businessweek later reported that Target's malware detection system had raised alerts during the attack and nobody acted on them. A detective control did its job; there was no response to correct the problem.
Source: Infosecurity Magazine: Target may have ignored pre-breach intrusion warning
How defenders stop it
- Pair every detective control with someone who acts on its alerts
- Layer controls so one failure isn't the whole defence
- Add a compensating control when a system can't meet the standard, and write down why
- Review controls after incidents: which one should have stopped this?
Check yourself
1. An intrusion detection system alerts the SOC but lets the traffic through. What type of control is it?
- Preventive
- Detective
- Corrective
- Directive
Show answer
Detective. It notices and reports. A prevention system (IPS) would block the traffic.
2. Which category does a written acceptable use policy belong to?
- Technical
- Physical
- Managerial
- Corrective
Show answer
Managerial. Policies are decisions set by management. Corrective is a type, not a category.
3. What does the Target breach show about detective controls?
- They are useless
- They only work with someone ready to act on the alerts
- They replace preventive controls
- They should be switched off to reduce noise
Show answer
They only work with someone ready to act on the alerts. The alerts were raised; the missing piece was a response to them.
Answer them in the app to earn XP.
Next: Phishing & social engineering →