3.5.1. Control Types and Frameworks
💡 First Principle: Security controls are classified by what they do (preventative, detective, corrective) and how they do it (technical, administrative, physical) — mapping vulnerabilities to the right control types prevents the mistake of solving every problem with a technical fix when an administrative control would be more effective.
Control Classification by Function:
| Type | What It Does | Examples |
|---|---|---|
| Preventative | Stops the attack from occurring | Firewall, MFA, encryption, input validation |
| Detective | Identifies when an attack has occurred or is occurring | SIEM, IDS, audit logs, anomaly detection |
| Corrective | Restores normal operation after an incident | Patch, backup restoration, IR playbook |
| Responsive | Reacts to limit damage during an active attack | EDR isolation, firewall block, account disable |
| Compensating | Alternative control when primary control isn't feasible | Network isolation for unpatachable legacy system |
Control Classification by Implementation:
| Type | What It Means | Examples |
|---|---|---|
| Technical | Implemented in technology | Firewall rules, encryption, access controls, IDS |
| Administrative (Managerial) | Policies, procedures, and governance | Security policy, risk management process, training |
| Operational | Day-to-day procedures followed by people | Patch management process, incident response procedures, background checks |
For the exam: a scenario may describe a vulnerability and ask for the appropriate control. The answer requires knowing both function (we need something preventative) and implementation (administrative controls alone won't technically prevent this).
Compensating controls are particularly important when a primary control isn't feasible:
- Legacy system that can't be patched → network isolation + enhanced monitoring
- System that requires unencrypted protocol → encrypt the network layer (VPN/TLS tunnel)
- Vendor-maintained system with restricted patching → WAF in front of web-facing components
⚠️ Exam Trap: A compensating control is not the same as no control — it provides equivalent (or near-equivalent) security through an alternative means. PCI DSS formally recognizes compensating controls when primary controls aren't feasible, but they must be documented and justified. The exam tests whether you understand when compensating controls are appropriate vs. when the primary control can and should be implemented.
Reflection Question: An organization runs a business-critical application on Windows Server 2008, which reached end-of-life in January 2020 and no longer receives security patches. Immediate replacement will take 18 months. What combination of control types would you recommend, and why is each necessary?
