# Security Controls

>**Security controls** are **safeguards or countermeasures** put in place to **reduce risk**, **protect assets**, and **ensure the confidentiality, integrity, and availability (CIA)** of information systems.


|  **Categories**  |   **Preventive**   |  **Deterrent**  |    **Detective**   |        **Corrective**         |          **Compensating**         |        **Directive**        | 
| ---------------- | ------------------ | --------------- | ------------------ | ----------------------------- | --------------------------------- | --------------------------- |
|  **Technical**   |      Firewall      |  Splash Screen  |    System Logs     |        Backup Recovery        |      Block Instead of Patch       |    File Storage Policies    |
|  **Managerial**  | On-Boarding Policy |    Demotion     |   Login Reports    | Policies for Reporting Issues |        Separation of Duties       |     Compliance Policies     |
|  **Operational** |     Guard Shack    | Reception Desk  |  Property Patrols  |      Contact Authorities      |  Require Multiple Security Staff  | Security Training Policies  |
|  **Physical**    |      Door Lock     |  Warning Signs  |  Motion Detectors  |       Fire Extinguisher       |     Using a backup generator      |    Instructional Signage    |

---
## Security Control Categories

### Technical
- Controls implemented using systems
- Operating System Controls
- Firewalls, anti-virus

### Managerial/Administrative
- Administrative controls associated with security design and implementation
- Security policies, standard operating procedures

### Operational
- Controls implemented by people instead of systems
- Security guards, awareness programs

### Physical
- Limit physical access
- Guard shack, Fences, Locks, Badge Readers 

---

## Types of Security Controls 

### Preventive
Used to prevent or block access.
E.g. Firewall Rules, Policies, Guard Shacks, Door Locks

### Deterrent 
Used to discourage access but does not inherently prevent access
E.g. Splash Screens, Threats, Reception Desks, Warning Signs

### Detective 
Used to identify, log and store events relating to the access attempt
E.g. System Logs, Login Reports, Property patrol, Motion detectors

### Corrective 
Used to apply a control after an event has been detected or taken place 
E.g. Restoring from backup, Creating post action policies, Contacting law enforcement, Fire extinguisher usage 

### Compensating
Used to apply a security control using other means sometimes temporarily 
E.g.  Firewall blocks an application temporarily, using a generator after an outage

### Directive 
Used to instruct or direct a subject towards security compliance
E.g. Training, Instruction Signage, Creating compliance policies