Control Types and Purposes
You achieve access control through an entire set of controls which, identified by purpose, include
Preventive controls, for reducing risk
Detective controls, for identifying violations and incidents
Corrective controls, for remedying violations and incidents and improving existing preventive and detective controls
Deterrent controls, for discouraging violations
Recovery controls, for restoring systems and information
Compensating controls, for providing alternative ways of achieving a task
You implement most access control mechanisms with the primary goal of reducing risk (that is, they’re preventive in nature). Detective, corrective, deterrent, recovery, and compensating controls work in a complementary manner with preventive controls to help create an organization’s overall security posture.
For example, detective controls help to determine when preventive controls have failed, been bypassed, or are otherwise ineffective or non-existent. Corrective controls help an organization appropriately address access violations or other security incidents. Deterrent controls dissuade malicious or unauthorized activity. Recovery controls return systems and information to their original capabilities when damage has occurred, and compensating controls provide substitute control options for management when other more effective controls aren’t possible or feasible.
Many access control mechanisms aren’t mutually exclusive in purpose or function. For example, a security guard serves primarily a preventive and detective function, but can also be a strong deterrent and, with proper equipment and training, can assist in correcting and recovering from a security incident.
To keep all these concepts nicely organized, the various controls mentioned in the preceding list are often divided up into three distinct control categories: administrative, technical, and physical.
Administrative controls
Administrative controls include the policies and procedures that an organization implements as part of its overall information security strategy. Administrative controls ensure that technical and physical controls are understood and properly implemented in accordance with the organization’s security policy. The purpose of administrative controls is most often preventive and detective, although you can also implement them as deterrent and compensating controls. Administrative controls may include
Policies, standards, guidelines, and procedures
Security awareness training
Asset classification and control
Employment policies and personnel practices (background checks, job rotations, and separation of duties and responsibilities)
Account administration
Account, log, and journal monitoring
Review of audit trails
Technical controls
Technical (or logical) controls use hardware and software technology to implement access control.
Preventive technical controls include
Encryption: Data Encryption Standard (DES), Advanced Encryption Standard (AES), and Merkle-Hellman Knapsack
Access control mechanisms: Biometrics, smart cards, and tokens
Access control lists: Permission lists that define what a subject can or cannot do to an object
Remote access authentication protocols: Password Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), Remote Authentication Dial-In User Service (RADIUS), and Lightweight Directory Access Protocol (LDAP)
Detective technical controls include
Violation reports
Audit trails
Network monitoring and intrusion detection
Although technical controls are primarily preventive and detective, you may also use them for corrective, deterrent, and recovery purposes.
Physical controls
Physical controls ensure the safety and security of the physical environment. These are primarily preventive or detective in nature.
Preventive physical controls include
Security perimeters, such as fences, locked doors, and restricted areas
Guards and dogs
Detective physical controls include
Motion detectors
Video cameras
Often, physical controls are also deterrent in nature. For example, fences, locked doors, security guards and dogs, motion detectors, and video cameras, in addition to being preventive and detective controls, also function as effective deterrent controls, in many cases.