3 Security Controls and Defense in Depth

What security controls do

A Security control is a safeguard—such as a policy, procedure, device, or technical mechanism—that reduces risk to information, systems, or operations. Controls help protect confidentiality, integrity, and availability: access rules can limit disclosure, change approvals can help prevent unauthorized modification, and backup systems can support availability.

Ways to classify controls

Controls can be classified in more than one way. Administrative, technical, and physical controls describe the kind of safeguard, while preventive, detective, and corrective controls describe what it does in relation to an unwanted event. These classification schemes are not mutually exclusive, and one safeguard can fit several categories.

Administrative, technical, and physical safeguards

• Administrative controls establish how people and organizations manage security. Examples include security policies, employee training, background screening, incident-response plans, and rules for approving access.

• Technical controls use technology to protect systems and data. Examples include multifactor authentication, firewalls, encryption, endpoint protection, and automated audit logs.

• Physical controls protect buildings, equipment, and people from physical access or hazards. Examples include locks, security guards, visitor badges, cameras, and fire-suppression systems.

These labels are commonly used in practice. NIST also organizes controls into management, operational, and technical classes; physical and environmental protection is a control family in its catalog. Classification depends on the purpose and framework being used, and categories may overlap.

Functions in relation to events

Preventive, detective, and corrective controls describe how a control relates to an unwanted event:

• Preventive controls aim to stop an event or reduce its likelihood. Examples include least-privilege permissions, locked server rooms, and secure configuration standards.

• Detective controls identify or alert on events that have happened or may be happening. Examples include audit-log reviews, intrusion alerts, and door-access alarms.

• Corrective controls limit harm, restore operations, or address a discovered weakness. Examples include restoring clean backups, disabling a compromised account, and applying a security patch.

A control can serve more than one function. An automated alert is detective; the response process that investigates and contains the alert may be corrective. A backup can support recovery after disruption, while regular restoration tests can help detect whether the backup process is failing.

Layering controls

Defense in depth combines complementary controls across people, processes, technology, and physical environments. Rather than relying on one safeguard, it uses layers so that if one fails, another may still prevent, detect, or limit harm.

For example, protection for a company’s sensitive records might combine staff training and approval rules (administrative), multifactor authentication and encryption (technical), and controlled entry to the server room (physical). Monitoring may detect suspicious access, while incident-response procedures and tested backups can help contain and recover from an incident.

Layering does not guarantee security. It can, however, reduce the chance that one failure leads directly to a serious loss.

Selecting controls for risk

Risk-based control selection means choosing safeguards in response to assessed risks rather than treating selection as a checklist exercise. A practical process is:

1. Identify what must be protected and the potential harm to the organization, people, or services if it is compromised.

2. Assess threats, vulnerabilities, likelihood, and impact. Consider likely events such as stolen credentials, accidental deletion, equipment failure, or unauthorized entry.

3. Choose a suitable mix of controls. Consider preventive, detective, and corrective measures, as well as implementation cost, usability, operational impact, and applicable requirements.

4. Tailor and document the choice. A baseline or control catalog can provide a starting point, but controls should fit the system and its environment. Record responsibilities, exceptions, and any compensating controls.

5. Implement, assess, and monitor. Check that controls are present, operating as intended, and producing the expected result. Reassess after significant changes and monitor over time.

NIST’s Risk Management Framework describes a cycle of control selection, implementation, assessment, authorization, and ongoing monitoring.

Assessing and improving controls

Evaluation should test both design and operation. A control may be well designed on paper but poorly implemented, or it may work today but fail when systems or staff change.

Evidence can include configuration records, access reviews, logs, interviews, inspections, and tests. For example, an organization can verify that only approved staff have access to a restricted room, then test whether alarms and response procedures work as intended.

A control assessment is not only a pass-or-fail exercise. It can reveal gaps and Residual risk—the risk that remains after controls are applied. Decision-makers can use this information to improve safeguards, accept the remaining risk, or choose another response.