Theory: Classifying Security Controls
In Week 4 we turned risks from the risk register into policy. But a policy only states an intention: “printed lab results must not be left unattended” does not, by itself, stop a single sheet of paper from sitting in a printer tray. This week closes the loop. A security control is the concrete thing that makes a policy real, and this lesson shows how to sort controls along two independent dimensions, Function and Nature, so you can see what a set of controls covers and where the gaps are.
From Risk to Control
Weeks 3, 4 and 5 form one chain. Each step answers a different question:
Diagram loads as you scroll.
Recall the Week 4 policy hierarchy: Policy (what must be done) → Standard (mandatory specifics) → Procedure (step-by-step how-to) → Guideline (recommended practice). None of these documents stops an attack on its own. The question of the week is:
“We wrote the policy. How do we know it is actually enforced?”
What Is a Security Control?
Security control: a concrete safeguard (a mechanism, process, or physical measure) that reduces risk and enforces a policy in practice.
- The policy says WHAT must happen.
- The control is HOW it actually happens.
Mini-example (MediCare Plus Hospital)
- Policy: “Patient records must be accessed only by authorized staff.”
- Control: Role-based access control (RBAC) on the EHR system, so that the system itself refuses to open a record for a user whose role is not authorized.
The policy sentence is not a control. RBAC is, because it is something that actually happens every time someone tries to open a record.
Common mistake: answering “what control would you use?” by restating the policy, e.g. “staff must not leave printouts unattended.” That is still the policy. A control must name a real tool, process, or physical measure (pull printing, a supervisor walk-through, a locked room).
Dimension 1: Classify by Function (When Does It Act?)
The function of a control describes what it does about an incident, which is easiest to remember by asking when it acts relative to the incident.
| Function | What it does | When it acts | Examples |
|---|
| Preventive | Stops an incident before it happens | Before | Firewall, MFA, locked door |
| Detective | Notices that an incident is happening or has happened | During / after | Intrusion detection system (IDS), log monitoring, CCTV |
| Corrective | Restores normal operation after an incident | After | Backup restore, patching, re-keying locks |
| Deterrent | Discourages the attempt in the first place | Before (in the attacker’s mind) | Warning banner, visible camera |
Preventive vs. Deterrent
Both act before an incident, so they are the easiest pair to confuse.
- A preventive control physically or technically blocks the action. A locked door stops you even if you are determined.
- A deterrent control only discourages it. A “this area is monitored” sign does not stop a determined intruder; it relies on the person deciding the risk of being caught is not worth it.
Exam test for Preventive vs. Deterrent: imagine an attacker who ignores the control completely. If they are still stopped, it is preventive. If they can walk straight through, it was only deterrent.
Detective vs. Corrective
- A detective control produces information (“someone did this”). It does not fix anything.
- A corrective control changes the situation back to normal (restores the data, closes the hole, re-keys the lock).
An incident usually needs both: you cannot correct what you never detected.
Dimension 2: Classify by Nature (How Is It Enforced?)
The nature of a control describes what kind of thing enforces it.
| Nature | Enforced by | Examples |
|---|
| Administrative | People, process and paper | Policy, security awareness training, background checks, approval workflows, access reviews |
| Technical | Systems and software | Encryption, firewalls, MFA, RBAC, audit logs |
| Physical | The physical world | Locks, badges, fences, security guards, locked server rooms |
To find the nature, ask “who or what does the enforcing?” A human following a rule → Administrative. A computer that refuses or records automatically → Technical. A wall, lock or guard in the real world → Physical.
Putting It Together: the Function × Nature Matrix
The two dimensions are independent, so every control sits in one cell of a 4 × 3 grid. The slide examples:
| Function / Nature | Administrative | Technical | Physical |
|---|
| Preventive | Security awareness training | Firewall / MFA | Locked server room |
| Detective | Mandatory access review | Intrusion detection system | Security camera (CCTV) |
| Corrective | Incident response plan | Automated backup restore | Re-key locks after a breach |
| Deterrent | Signed acceptable use agreement | Login banner: “activity is monitored” | Visible security camera signage |
Some cells deserve a second look:
- Training is preventive. It aims to stop staff from making the mistake in the first place (e.g. falling for a phishing email).
- An access review is detective. It discovers access that should not exist; removing that access afterwards is the corrective step.
- CCTV recording is detective, but a visible camera sign is deterrent. The same camera can serve both functions: the recording helps you find out what happened, while its visibility discourages the attempt.
- A signed acceptable use agreement is deterrent. Signing your name to the rules and their consequences discourages misuse; it cannot physically stop it.
Design rule: a well-defended system does not rely on one cell. It spreads controls across the whole matrix, so that if prevention fails, something still detects, corrects, and discourages. This idea becomes the Defense in Depth principle in 5.2.
Worked Example: One Policy, Three Controls
MediCare Plus Hospital’s Week 4 policy: “Printed lab results must not be left unattended on shared printers.” Three very different controls can all enforce it:
| Control | Function | Nature |
|---|
| Printer relocated to a staff-only, badge-access room | Preventive | Physical |
| Follow-me / pull printing: the job only prints when the user badges in at the printer | Preventive | Technical |
| Periodic walk-through audits of printer trays by a supervisor | Detective | Administrative |
Notice that the badge door is a physical control (the wall and lock keep people out), while badge-release printing is technical (the print server software decides whether to release the job). The badge is only the token; classify by what does the enforcing.
Which control is “best” depends on cost, feasibility, and the design principle behind it. That is the subject of 5.2.
Diagnosing Control Gaps
Classification is also a diagnostic tool. Given an existing policy, ask for each policy statement:
- Is there any control that enforces it? A policy statement with no control behind it is “just words”: nobody would notice if it were broken.
- Which cells of the matrix are covered? If every control is administrative (a policy document plus training), nothing technical or physical stops a careless or malicious person.
- Is there anything detective? If a preventive control fails silently, will anyone ever know?
- Is there anything corrective? If the worst happens, how does the organization recover?
Mini-example
MediCare Plus’s AUP says “Staff must not connect personal USB drives to any clinical workstation.” The only controls are the AUP document and annual training (both administrative). Gap: nothing technical stops a USB drive being used, and nothing detects it. A device-control setting that blocks unapproved USB storage (preventive, technical) plus logging of blocked attempts (detective, technical) would close the gap.
Worked Examples
Exercise 1
Classify each control at MediCare Plus Hospital by Function (Preventive / Detective / Corrective / Deterrent) and Nature (Administrative / Technical / Physical).
- Staff must enter a password and tap their badge to log in to the EHR.
- A sign at the server room door reads “Authorized personnel only. Entry is recorded.”
- A supervisor reviews the list of user accounts every quarter to find accounts that should have been disabled.
- After ransomware, IT restores the billing database from last night’s backup.
- A security guard checks ID at the entrance to the pharmacy store room.
- New staff must complete phishing-awareness training before receiving an email account.
- An intrusion detection system raises an alert on unusual traffic to the lab system.
- After a master key is lost, all locks on the medical records room are changed.
Show solution ↓Hide solution ↑
Solution
For each control, ask two questions: when does it act (function) and who or what enforces it (nature).
| # | Control | Function | Nature | Reasoning |
|---|
| 1 | Password + badge login | Preventive | Technical | The system refuses entry before access happens. |
| 2 | Warning sign | Deterrent | Physical | It only discourages; a determined intruder can ignore a sign. It exists in the physical world. |
| 3 | Quarterly account review | Detective | Administrative | A person following a process discovers bad accounts; it does not stop or fix anything by itself. |
| 4 | Restore from backup | Corrective | Technical | Restores normal operation after the incident, performed by systems. |
| 5 | Guard checks ID | Preventive | Physical | Blocks unauthorized people before they enter; enforced in the real world. |
| 6 | Awareness training | Preventive | Administrative | Aims to stop the mistake (clicking a phishing link) before it happens; it is a people/process control. |
| 7 | IDS alert | Detective | Technical | Notices an attack in progress; a system does it. |
| 8 | Re-keying locks | Corrective | Physical | Restores security after the loss of the key; done to physical locks. |
Exercise 2
A hospital installs cameras in its car park. In one version, the cameras are hidden and record to a server that security staff review after any reported incident. In another version, the cameras are highly visible with large signs saying “CCTV in operation.”
Classify the function of each version, and explain why the same device can be classified differently.
Show solution ↓Hide solution ↑
Solution
Hidden cameras that record: nobody knows they are there, so they cannot discourage anyone. Their value is the recording, which lets staff find out what happened and who did it. That is Detective (Physical).
Visible cameras with signs: the visibility is aimed at the would-be thief’s decision before they act: “I might be identified, so it is not worth it.” That is Deterrent (Physical). If they also record, they are detective as well.
Why the difference: a control is classified by what it does, not by what the device is. The same hardware can play different roles depending on how it is deployed. So the answer is: hidden recording cameras = Detective; visible signed cameras = Deterrent (and Detective if recording).
Exercise 3
Which of the following are security controls, and which are policy statements? Explain the difference.
- (a) “Patient records must be accessed only by authorized staff.”
- (b) Role-based access control on the EHR.
- (c) “Lost devices must be reported to IT within 1 hour.”
- (d) A remote-wipe tool that erases a lost laptop when IT triggers it.
- (e) A supervisor’s weekly walk-through of printer trays.
Show solution ↓Hide solution ↑
Solution
A policy states what must happen. A control is the concrete tool, process or physical measure that makes it happen.
- (a) Policy: it states a requirement but enforces nothing.
- (b) Control (preventive, technical): the system actually blocks unauthorized users.
- (c) Policy (a mandatory, measurable requirement): it tells staff what to do, but something else must enforce or check it.
- (d) Control (corrective, technical): it limits the damage after a device is lost.
- (e) Control (detective, administrative): a real process carried out by a person.
Final answer: (b), (d) and (e) are controls; (a) and (c) are policy statements. A useful self-check: if you could break the statement without anything noticing or stopping you, it is a policy, not a control.
Exercise 4
MediCare Plus’s Access Control Policy says: “Shared or generic login accounts are prohibited on any workstation with EHR access.” Currently the only controls are (1) the policy document itself and (2) a slide in the onboarding training.
Diagnose the control gap, then propose one preventive technical control and one detective control that would close it.
Show solution ↓Hide solution ↑
Solution
Step 1: classify the existing controls. The policy document and the training are both Administrative; training is Preventive. There is nothing Technical or Physical, and nothing Detective.
Step 2: state the gap. Nothing stops a ward from creating or using a shared “nurse1” account, and nothing detects that it is happening. If a busy ward ignores the rule, nobody would know until an incident needs to be traced and the log only says “nurse1.”
Step 3: propose controls.
- Preventive, Technical: the EHR only accepts logins from accounts linked to a named employee record in HR (accounts are created only through the provisioning process; generic accounts cannot be created), with badge-tap login so that individual login is quick enough that staff are not tempted to share.
- Detective, Technical (or Administrative): an automated report flags any account logged in at two workstations at the same time, or any account name not matched to an HR record; IT reviews it weekly.
Final answer: the gap is that enforcement is purely administrative and preventive. Add a technical preventive control (individual, HR-linked accounts with badge login) and a detective control (concurrent-login / unmatched-account report).
Exercise 5
For the risk “ransomware encrypts the MediCare Plus EHR server”, propose one control for each function (Preventive, Detective, Corrective, Deterrent) and give its nature.
Show solution ↓Hide solution ↑
Solution
Work through the incident timeline: before (prevent, deter), during (detect), after (correct).
| Function | Example control | Nature |
|---|
| Preventive | Patch the EHR server within a set time after vendor release; block macro-enabled email attachments | Technical |
| Deterrent | Login banner on all workstations: “Activity is monitored; misuse leads to disciplinary and legal action” | Technical |
| Detective | Endpoint monitoring that alerts on mass file encryption or renaming | Technical |
| Corrective | Restore the EHR from offline backups, following the incident response plan | Technical (restore) + Administrative (IR plan) |
Many other answers are valid (e.g. phishing training as preventive administrative). Note that deterrence is weak against remote criminal gangs, which is exactly why a design should not depend on any single function.
Final answer: one control per function as above, covering before, during and after the incident.