16.3 Security Controls and Safeguard Selection
Controls Are Named by What They Do
Controls are grouped by function into three families. Preventive controls stop an incident before it happens: firewalls dropping unwanted traffic, multi-factor authentication blocking stolen passwords, disk encryption, and a deadbolt on the server room. Detective controls do not stop anything but tell you something is happening: centralized logs, file-integrity monitors, login alerts, and a camera recording the door someone propped open. Corrective controls act after detection: restoring from backups, running an incident-response playbook, revoking sessions, patching the exploited flaw. A mature setup has all three; teams that only buy preventive tools are blind to failures and helpless after them.
Nature Cuts Across Function
A second, orthogonal taxonomy sorts controls by nature: technical (the firewall rule), administrative (the policy that requires the rule and the review that checks it), and physical (the lock, the rack, the cable lock). The same risk usually needs all natures at once -- MFA is technical, the enrollment mandate is administrative, and the badge-controlled office is physical. When choosing, map candidate controls onto both taxonomies at once: "detective, technical" gaps (like "nobody would notice a deleted audit log") are the ones most often missing in beginner setups.
Layer, Verify, and Compensate
Selection follows the register, not the catalog: take the highest-scoring row and buy the control that cuts its likelihood or impact most per dollar. Stack families so that when one layer fails -- firewall bypassed, MFA fatigued -- the detective layer notices and the corrective layer recovers. If the ideal control is unaffordable or impossible, pick a compensating control that attacks the same risk from another angle, such as shortening session timeouts because you cannot yet afford a full identity provider; document the substitution so the next reviewer knows the gap is known.
Architecture Diagram
Key Takeaways
- Preventive controls block incidents, detective controls reveal them, corrective controls undo them.
- Technical, administrative, and physical natures cut across all three families; most risks need all of them.
- Buy for the top register row, choosing the control with the most risk reduction per dollar.
- When one layer fails, the next family must notice and recover -- detection and backup are not optional extras.
- Use compensating controls when the ideal control is out of reach, and record that swap in the register.