Lesson 2.7: Security controls: preventive, detective, corrective
A control is anything that reduces risk. Controls are grouped by what they do (preventive, detective, corrective, deterrent, compensating) and by what they are (administrative, technical, physical). In the lab you use one of each on a server: a firewall that prevents connections, a log search that detects a password-guessing attack, and you read a policy, the administrative control behind them.
18 min
You will learn to
- Define a security control
- Classify controls as preventive, detective or corrective
- Classify controls as administrative, technical or physical
- Turn on a default-deny firewall that keeps the needed services open
- Detect a brute-force attempt in a log
Key terms
- Security control
- Any measure that reduces risk: a rule, a technology, a lock.
- Preventive control
- Stops an incident before it happens.
- Detective control
- Notices an incident while or after it happens.
- Corrective control
- Limits the damage and restores normal operation after an incident.
- Administrative, technical, physical
- The other way to sort controls: by what they are. Administrative: policies, training, procedures. Technical: firewalls, encryption, MFA. Physical: locks, guards, badges.
- Firewall
- A control that allows or blocks network traffic according to rules.
- Brute-force attack
- Trying many passwords (or user names) automatically until one works.
← Getting help on the command line · All lessons · Looking at text files: cat, less and more →