decrypting…# Security Controls >**Security controls** are **safeguards or countermeasures** put in place to **reduce risk**, **protect assets**, and **ensure the confidentiality, integrity, and availability (CIA)** of information systems. | **Categories** | **Preventive** | **Deterrent** | **Detective** | **Corrective** | **Compensating** | **Directive** | | ---------------- | ------------------ | --------------- | ------------------ | ----------------------------- | --------------------------------- | --------------------------- | | **Technical** | Firewall | Splash Screen | System Logs | Backup Recovery | Block Instead of Patch | File Storage Policies | | **Managerial** | On-Boarding Policy | Demotion | Login Reports | Policies for Reporting Issues | Separation of Duties | Compliance Policies | | **Operational** | Guard Shack | Reception Desk | Property Patrols | Contact Authorities | Require Multiple Security Staff | Security Training Policies | | **Physical** | Door Lock | Warning Signs | Motion Detectors | Fire Extinguisher | Using a backup generator | Instructional Signage | --- ## Security Control Categories ### Technical - Controls implemented using systems - Operating System Controls - Firewalls, anti-virus ### Managerial/Administrative - Administrative controls associated with security design and implementation - Security policies, standard operating procedures ### Operational - Controls implemented by people instead of systems - Security guards, awareness programs ### Physical - Limit physical access - Guard shack, Fences, Locks, Badge Readers --- ## Types of Security Controls ### Preventive Used to prevent or block access. E.g. Firewall Rules, Policies, Guard Shacks, Door Locks ### Deterrent Used to discourage access but does not inherently prevent access E.g. Splash Screens, Threats, Reception Desks, Warning Signs ### Detective Used to identify, log and store events relating to the access attempt E.g. System Logs, Login Reports, Property patrol, Motion detectors ### Corrective Used to apply a control after an event has been detected or taken place E.g. Restoring from backup, Creating post action policies, Contacting law enforcement, Fire extinguisher usage ### Compensating Used to apply a security control using other means sometimes temporarily E.g. Firewall blocks an application temporarily, using a generator after an outage ### Directive Used to instruct or direct a subject towards security compliance E.g. Training, Instruction Signage, Creating compliance policies