TyscorpaControl Categories
Security controls are grouped by who implements them:
| Category | Description | Examples |
|---|---|---|
| Technical | Hardware/software mechanisms enforced by systems | Firewalls, antivirus, encryption, ACLs, MFA |
| Managerial | Policies and procedures defined by management | Security policies, risk assessments, DR plans |
| Operational | Day-to-day procedures performed by people | Security awareness training, background checks, incident response procedures |
| Physical | Tangible, real-world mechanisms | Locks, fences, cameras, badge readers, guards, lighting |
Control Functional Types
Controls are also classified by the timing and intent of their action:
| Type | Timing | Purpose | Examples |
|---|---|---|---|
| Preventive | Before attack | Eliminate or reduce likelihood of attack succeeding | Firewall rules, ACLs, antimalware, encryption |
| Detective | During attack | Identify and record attempted or successful intrusions | IDS, audit logs, SIEM alerts, motion sensors |
| Corrective | After attack | Reduce impact; restore systems to normal state | Backup restoration, patch management, incident response |
| Directive | Before attack | Enforce rules of behavior through policy | Acceptable use policies, employee contracts, training programs |
| Deterrent | Before attack | Discourage attacks psychologically | Warning banners, security cameras (visible), legal notices |
| Compensating | Any | Substitute for a principal control; provides equivalent or better protection | Using OTP when smart card is unavailable |
| Responsive | After detection | React to a confirmed event | Quarantining a host, blocking an IP, revoking access |
Exam Tip: Controls can be both a category AND a type simultaneously. For example, a firewall is a technical (category) + preventive (type) control. A visible security camera is a physical + deterrent + detective control. Expect questions that ask you to identify both dimensions.
Real-World Example
A bank wants to protect its ATM network. It uses:
- Physical + Preventive: Steel casing and tamper-resistant enclosures on ATMs
- Technical + Preventive: Encrypted PIN entry pads
- Technical + Detective: Anomaly detection software flagging unusual withdrawal patterns
- Operational + Directive: Staff procedures for daily ATM cash reconciliation
- Compensating: Manual teller transaction log reviews when the ATM audit system is down