Security Controls Overview
Introduction to security controls as safeguards designed to reduce risk and protect confidentiality, integrity, and availability. Understanding the dual classification system of categories and control types.
Understanding Security Controls Overview
Security controls are the foundation of any cybersecurity program. They are safeguards or countermeasures designed to protect the confidentiality, integrity, and availability of information systems and the data they contain.
Think of security controls as the locks, alarms, cameras, and guards that protect a building—but for your digital assets. Just as a building might use multiple layers of physical security, organizations implement multiple security controls to create a comprehensive defense strategy.
Why This Matters for the Exam
This concept appears throughout the entire Security+ exam because every security measure you'll study is a type of control. Understanding the classification system helps you:
- •Quickly identify what type of control a question is asking about
- •Recognize gaps in security architectures
- •Recommend appropriate controls for different scenarios
- •Understand why organizations implement multiple overlapping controls
Deep Dive
CompTIA uses a dual classification system for security controls. Every control can be classified by both its category (who/what implements it) and its type (what it does):
Control Categories (Implementation)
- •Technical (Logical) — Implemented through technology
- •Managerial (Administrative) — Implemented through policies
- •Operational — Implemented through daily procedures
- •Physical — Implemented through tangible barriers
Control Types (Function)
- •Preventive — Stops incidents before they occur
- •Detective — Identifies incidents during or after
- •Corrective — Fixes issues after an incident
- •Deterrent — Discourages malicious behavior
- •Compensating — Substitutes for other controls
- •Directive — Guides behavior through rules
How CompTIA Tests This
Example Analysis
A firewall is a technical control (category) that is preventive (type) because it's implemented through technology and stops unauthorized traffic before it enters the network.
A security awareness training program is a managerial control (category) that is preventive (type) because it's established by management and aims to prevent security incidents by educating users.
Key Terms to Know
Common Mistakes to Avoid
Exam Tips
Memory Trick
"TMOP" for Categories: Technical, Managerial, Operational, Physical
"PD-CCD" for Types: Preventive, Detective, Corrective, Compensating, Deterrent (plus Directive)
Think: "The Manager Operates Physically" and "Police Detect Criminals, Courts Decide"
Test Your Knowledge
Q1.A company implements a firewall to block unauthorized network traffic. What type of control is this?
Q2.An organization requires all employees to complete annual security awareness training. What category of control is this?
Q3.A security camera records activity in a server room. This camera serves as which types of control? (Select the BEST answer)
Want more practice with instant AI feedback?
Practice with AIContinue Learning
Ready to test your knowledge?
Practice questions on security controls overview and other Objective 1.1 concepts.