A security control is any measure that reduces risk. There are many, but they group neatly into three families — and into what each one is for.
What is it?
Controls are usually sorted two ways: by how they work and by what they do.
Select any component in the diagram to read what it does.
Text description of this diagram
Controls are the safeguards that reduce risk. They work in three ways.
By how they work
- Technical — technology does the work (firewalls, antivirus, encryption).
- Administrative — rules and processes (policies, training, approvals).
- Physical — the real world (locked doors, cameras, security guards).
By what they do
- Preventive — stop an attack before it happens (a lock on the door).
- Detective — spot an attack in progress (an alarm or camera).
- Corrective — fix things afterwards (restoring from a backup).
Why is it important?
A strong defence needs a mix. Preventive controls alone are not enough — some attacks will get through, so you need detective controls to notice and corrective controls to recover. This mix is exactly how defence in depth is built.
How does it work?
Good design places controls across all the categories. For example, protecting a laptop might combine a password (technical, preventive), security training (administrative, preventive), monitoring software (technical, detective), and backups (technical, corrective).
A real-world example
A bank branch shows all three physical types at once: locked vaults (preventive), CCTV cameras (detective), and insurance plus recovery plans (corrective). Digital security uses the very same thinking, just with software.
Check what you learned
Name the three families of controls by how they work.
Technical, administrative, and physical.
What is the difference between a preventive and a detective control?
Preventive controls stop an attack before it happens; detective controls spot one that is in progress.
Key takeaways
- Controls can be technical, administrative, or physical.
- They can be preventive, detective, or corrective.
- A strong defence mixes controls from across every category.