[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 2 · 2.1.f
AP Cybersecurity · Securing Spaces
Types of Security Controls
Three labels at once: the principle it serves, where it lives, and what it does.
key ideaA control is described three ways at once: the principle it serves, its type, and its function.
The categories
These are not competing schemes. Every control has all three labels simultaneously — a door lock is physical by type, preventative by function, and serves confidentiality. Being able to state all three is what the exam asks for.
Type answers where the control operates; function answers what it does about an attack. The two axes are independent — a camera is physical and detective, a firewall is technical and preventative.| Principle | What it guarantees | What its absence allows |
|---|
| confidentiality | only authorized parties can access data | data theft or destruction |
| integrity | data are accurate and trustworthy | unauthorized modification nobody detects |
| availability | data and services are reachable when needed | disruption — the service is simply gone |
Every control serves at least one of these. Naming which one is how you justify the control — a backup is about availability, encryption about confidentiality, a checksum about integrity.
Confidentialityonly the authorized can read it
Integritythe data are accurate and unaltered
Availabilityit is there when needed
| Physical | Technical | Managerial |
|---|
| operates in | the physical space | the digital space | the organization itself |
| examples | locks, fences, cameras, bollards, guards | firewalls, anti-malware, encryption | policies, training, procedures |
| fails when | someone is let in | software is bypassed | people do not follow it |
| cost profile | capital, then maintenance | licensing and configuration | mostly time and attention |
Managerial controls are the ones students under-rate. A policy nobody follows is a control that does not exist — which is why training belongs in this row and not as an afterthought.
| Function | Relative to the attack | Examples |
|---|
| preventative | before — stops it | locks, encryption, bollards, MFA |
| detective | during or after — reveals it | intrusion detection, camera review, log alerts |
| corrective | after — restores from it | backups, generators, incident response |
A complete defense needs all three. Prevention-only security fails silently: when it is bypassed there is nothing to notice it and nothing to recover with.
Telling them apart
how to classify
- Ask where it operates for the type, and when it acts for the function.
- A single control can be two functions at once — a card reader prevents and logs.
- Managerial controls are real controls; policies and training belong in the answer.
- Name the principle too — confidentiality, integrity or availability — to justify it.
Worked examples
EX 1
Classify one control three ways
A server-room door has a badge reader that logs every swipe. Classify it fully.
1
Give the type
It exists in the physical space, so it is a physical control.
2
Give the primary function
It stops an unbadged person entering — preventative.
3
Give the second function
It records who entered and when — also detective.
4
Give the principle
It protects the systems inside, so primarily confidentiality, and availability against sabotage.
5
State the full answer
Physical, preventative and detective, serving confidentiality and availability.
EX 2
The control with no technology
An organization requires two people to approve any payment above $5,000. Classify it and say what it defends against.
1
Give the type
No hardware, no software — it is a managerial control.
2
Give the function
It stops a fraudulent payment before it happens: preventative.
3
Give the principle
Integrity — it keeps transactions accurate and authorized.
4
Say what it defends against
Both insider fraud and social engineering aimed at a single approver.
5
Note the point
A rule can be as effective as a device, and often cheaper. It fails only if people route around it.
EX 3
A defense with a hole
A small firm has locks, a firewall, encryption and anti-malware. It has no logging, no camera review, and no backups. Diagnose the gap.
1
Classify what exists by function
Locks, firewall, encryption, anti-malware — all preventative.
2
Identify what is missing
Nothing detective, nothing corrective.
3
Describe the failure mode
When prevention is bypassed, nobody notices and nothing can be restored.
4
Name the affected principle
Availability in particular — ransomware with no backups is unrecoverable.
5
Recommend
Add logging with alerting and tested offline backups before buying any more prevention.
Watch out
Type and function are different questions
‘Physical’ answers where the control lives; ‘preventative’ answers what it does. A camera is physical and detective; a firewall is technical and preventative.
One control can have two functions
A logging card reader both prevents and detects. Listing only one function is an incomplete classification.
Managerial controls count
Policies, training and procedures are controls under the CED. An answer listing only devices has missed a whole category.
Prevention alone is a brittle design
Without detective and corrective controls, a bypass is silent and permanent. Defense in depth means covering all three functions, not buying more locks.