3.5.1. Control Types and Frameworks
💡 First Principle: Security controls are classified by what they do (preventative, detective, corrective) and how they do it (technical, administrative, physical) — mapping vulnerabilities to the right control types prevents the mistake of solving every problem with a technical fix when an administrative control would be more effective.
Control Classification by Function:
| Type | What It Does | Examples |
|---|---|---|
| Preventative | Stops the attack from occurring | Firewall, MFA, encryption, input validation |
| Detective | Identifies when an attack has occurred or is occurring | SIEM, IDS, audit logs, anomaly detection |
| Corrective | Restores normal operation after an incident | Patch, backup restoration, IR playbook |
| Responsive | Reacts to limit damage during an active attack | EDR isolation, firewall block, account disable |
| Compensating | Alternative control when primary control isn't feasible | Network isolation for unpatchable legacy system |
Control Classification by Implementation:
| Type | What It Means | Examples |
|---|---|---|
| Technical | Implemented in technology | Firewall rules, encryption, access controls, IDS |
| Administrative (called managerial in older material) | Policies, procedures, and governance | Security policy, risk management process, training, background checks |
| Physical | Tangible barriers and controls on facilities and equipment | Security guards, badge checks, locks, bollards, cameras |
For the exam: a scenario may describe a vulnerability and ask for the appropriate control. The answer requires knowing both function (we need something preventative) and implementation (administrative controls alone won't technically prevent this).
Compensating controls are particularly important when a primary control isn't feasible:
- Legacy system that can't be patched → network isolation + enhanced monitoring
- System that requires unencrypted protocol → encrypt the network layer (VPN/TLS tunnel)
- Vendor-maintained system with restricted patching → WAF in front of web-facing components
Virtual patching is the name for this class of compensating control: a WAF, IPS or firewall rule that blocks the exploit pattern for a specific vulnerability without changing the vulnerable application. It buys time while the real fix is tested or awaited, but it does not remove the flaw. The vulnerability stays open in the report, a rule bypass or an application change can expose it again, and the permanent fix is still the patch. "We have a WAF" is therefore a reason to lower urgency, not to close the finding.
⚠️ Exam Trap: A compensating control is not the same as no control — it provides equivalent (or near-equivalent) security through an alternative means. PCI DSS formally recognizes compensating controls when primary controls aren't feasible, but they must be documented and justified. The exam tests whether you understand when compensating controls are appropriate vs. when the primary control can and should be implemented.
Reflection Question: An organization runs a business-critical application on Windows Server 2008, which reached end-of-life in January 2020 and no longer receives security patches. Immediate replacement will take 18 months. What combination of control types would you recommend, and why is each necessary?
