4.3. Security Control Design and Implementation

💡 First Principle: A control chosen purely for technical elegance, without weighing its cost and business friction, is a control that will get quietly bypassed the first time it slows down someone with enough authority to route around it.

⚠️ Common Misconception: Preventive controls are often assumed to be categorically superior to detective controls. Layered defense needs both — some risks, like insider threats or zero-day exploits, can't be fully prevented and require strong detective and corrective controls working alongside prevention.

This section moves through three related but distinct disciplines that a mature program treats as separate steps rather than one continuous "set it and forget it" action: choosing the right category and design of control for a given risk, actually building that control into daily operations so it functions as intended, and then proving — on an ongoing, recurring basis — that it still works as the environment around it keeps changing. Skipping any one of the three is how a program ends up with a control that looks complete on paper but isn't actually managing the risk it was chosen for.