Welcome to your third lesson. In our previous session, we built a precise vocabulary to describe security problems, differentiating between threats, vulnerabilities, risks, and exploits. We learned that a threat actor uses an exploit against a vulnerability, creating risk. Now, we shift our focus from problems to solutions.
This lesson is about the specific measures we implement to protect our systems and data: security controls. As an aspiring SOC Analyst, your daily work will revolve around these controls—monitoring alerts from detective controls, implementing corrective actions, and understanding how preventive controls failed after an incident. Today, you will learn to classify controls by their function, specifically focusing on preventive, detective, corrective, and compensating controls, along with a few other common types. Mastering this classification is fundamental to understanding how a layered security strategy is built and maintained.
What are Security Controls?
In the simplest terms, security controls are the safeguards or countermeasures we put in place to manage risk. They are the practical steps we take to protect the confidentiality, integrity, and availability (CIA) of our assets.
No single control is a silver bullet. A firewall is great, but it won't stop an employee from clicking a phishing link. This is why we use a strategy called defense-in-depth, where we layer multiple controls to create a more resilient defense. If one control fails, another is there to back it up. Understanding the different types of controls is the first step in building an effective layered defense.
Classifying Controls by Function
The most common way to classify controls is by their function—what they are designed to do in relation to a security incident. Do they stop it from happening, detect it while it's in progress, or help clean up the mess afterward?
The image below provides a great overview of the primary functional control types. Think of them as operating at different stages of an attack.
We will focus on these functional types, which are essential for your role as a SOC analyst. Let's begin our deep dive with a video from Professor Messer, a highly respected source in the cybersecurity training community. He provides excellent, clear-cut examples for each control type, and we will watch it in segments as we explore each one.
Security Controls - CompTIA Security+ SY0-701 - 1.1
This video, "Security Controls" by Professor Messer, will serve as our guide. It masterfully explains the main control types while also categorizing them by their implementation (technical, managerial, operational, and physical), which adds a valuable layer of understanding.
We will break down the video by control type. For now, just be aware of the structure.
1. Preventive Controls: The First Line of Defense
Preventive controls are proactive. Their goal is to stop an incident from occurring in the first place. They are the walls, locks, and rules that enforce security before any harm is done. For a SOC analyst, a world full of perfect preventive controls would be a quiet one—but reality is rarely so simple.
Watch this segment from the video to see examples of preventive controls.
Security Controls - CompTIA Security+ SY0-701 - 1.1
Now, watch the first segment on preventive controls.
Focus on the section from the beginning of the explanation to the end of the physical category example. Notice how a firewall rule (technical) and a door lock (physical) both serve the same function: to prevent unauthorized access.
Examples of Preventive Controls include:
- Firewalls: Block unauthorized network traffic.
- Encryption: Makes data unreadable without the proper key.
- Strong Authentication: Requires users to prove their identity before granting access.
- Security Policies: Formal rules that dictate acceptable and unacceptable behavior.
2. Detective Controls: The Eyes and Ears
This is where the life of a SOC analyst truly begins. Detective controls are designed to identify and alert you that an incident is in progress or has already occurred. They don't stop the attack, but they provide the crucial visibility needed to respond. Your SIEM (Security Information and Event Management) tool will be flooded with events generated by detective controls.
Let's see what Professor Messer has to say about them.
Security Controls - CompTIA Security+ SY0-701 - 1.1
Next, watch the segment on detective controls.
Watch from the start of the detective section until the physical category example. Pay attention to how system logs and login reports are the raw data that fuel detection.
Examples of Detective Controls include:
- Intrusion Detection Systems (IDS): Monitor network traffic for signatures of known attacks.
- SIEM Systems: Aggregate and correlate log data from multiple sources to identify suspicious patterns.
- Security Cameras (CCTV): Record activity in physical locations.
- Audit Logs: Record events like file access, login attempts, and configuration changes.
3. Corrective Controls: The Clean-Up Crew
Once a detective control has fired an alert and you've confirmed an incident, you need to take action. Corrective controls are used to limit the damage, fix the issue, and hopefully prevent it from happening again. As a Tier 1 SOC Analyst, your role might involve applying initial corrective controls like isolating a compromised machine from the network.
Watch the next segment on corrective controls.
Security Controls - CompTIA Security+ SY0-701 - 1.1
Now for the corrective control segment.
Watch the section from the beginning of the explanation through the fire extinguisher example. The key idea here is that these controls are applied after an event to fix the damage.
Examples of Corrective Controls include:
- Patch Management: Applying a software update to fix the vulnerability that was exploited.
- Restoring from Backups: Recovering data or systems to a known-good state after a ransomware attack.
- Antivirus Software: Removing malware that has been detected on a system.
- Incident Response Plan: The procedures followed by the SOC to contain and eradicate a threat.
4. Deterrent, Recovery, and Compensating Controls
While Preventive, Detective, and Corrective are often considered the "big three," several other types are crucial for a complete strategy. The learning outcome specifically calls out Compensating controls, which are particularly important.
-
Deterrent Controls: These are designed to discourage an attacker by raising the perceived difficulty or risk of an attack. Think of a "Beware of Dog" sign—it doesn't physically stop anyone, but it might make them think twice. Warning banners on login screens ("All activity on this system is monitored") are a classic technical deterrent.
-
Recovery Controls: These are closely related to corrective controls but focus specifically on restoring business operations after a disaster. A full disaster recovery plan, including offsite backups and failover data centers, falls into this category.
-
Compensating Controls: This is a vital concept. A compensating control is an alternative measure you put in place when it's not possible to implement the desired primary control. For example, you have a critical legacy server that can't be patched (a preventive control failure). A compensating control would be to place it on an isolated network segment, protected by a dedicated firewall, to reduce its exposure.
Let's watch Professor Messer's explanation of compensating controls.
Security Controls - CompTIA Security+ SY0-701 - 1.1
This final segment on compensating controls is crucial.
Watch the section from the start of the compensating section until the power generator example. The application developer example is a perfect real-world scenario you might encounter.
To solidify your understanding of all these functional types, let's turn to a textual resource that provides more detailed scenarios.
Types of Security Controls : A Complete Guide to Cybersecurity Defense
The article from JanBask Training provides an excellent "Deep Dive" into each functional control type, complete with real-world context that's very helpful for seeing how these concepts apply.
First, quickly review the section Classification by Function for a concise summary. Then, read the "Deep Dive" section more carefully, from "A. Preventive Controls" through "F. Compensating Controls". As you read, try to think of other examples for each control type.
A Practical Scenario: Phishing Attack
Let's trace a phishing attack through our control framework to see how the layers work together:
- An attacker sends a phishing email to an employee.
- Preventive: The company's email security gateway scans the email, detects a malicious link, and quarantines the message. The attack stops here.
- What if the gateway misses it? The email lands in the employee's inbox.
- Deterrent: The employee recently completed security awareness training and remembers not to click links from unknown senders. They report the email. The attack stops here.
- What if the employee clicks the link? Their browser opens a malicious website.
- Detective: A SIEM alert fires, indicating a host on the internal network is communicating with a known malicious domain. The SOC is now aware of the problem.
- Corrective: The SOC analyst follows the incident response plan. They use an endpoint security tool to isolate the employee's computer from the network to prevent the spread of malware. Then, they block the malicious domain on the company's web proxy and firewall.
- Compensating: It turns out the employee was using a personal, unmanaged laptop that lacked the corporate endpoint protection software. The primary preventive control (enforcing software on all devices) failed. However, the compensating control of having a strong network-based detective control (the SIEM) allowed the SOC to catch the activity anyway.
Conclusion
In this lesson, we moved from defining cybersecurity problems to outlining the solutions. You learned that security controls are the safeguards we use to manage risk and that they are most effective when layered in a defense-in-depth strategy.
Here are the key takeaways:
- Preventive Controls aim to stop incidents before they happen (e.g., firewalls, encryption).
- Detective Controls identify and alert on incidents as they occur (e.g., IDS, SIEM alerts, logs).
- Corrective Controls fix issues and contain damage after an incident (e.g., patching, restoring from backup).
- Deterrent Controls discourage attackers through perceived consequences (e.g., warning banners).
- Compensating Controls are alternative safeguards used when a primary control is not feasible (e.g., network isolation for an unpatchable system).
As a SOC Analyst, you will live in the world of detective and corrective controls, analyzing the alerts that fire when preventive controls fail and taking the necessary actions to secure your organization.
What's Next?
Now that you can classify individual controls, our next lesson will officially introduce the principle of defense-in-depth, exploring how to strategically combine these different control types to build a resilient and multi-layered security posture. We will also discuss the principle of least privilege, another core concept in limiting the potential damage of any single security failure.