DEFINITIONS

🔐 Introduction

When we talk about keeping things safe in the digital world, we’re really talking about security controls. These are the safeguards we put in place to protect systems, networks, and data from harm. Think of them as the locks, alarms, and guard dogs of the cyber world—but also the rules, habits, and training that keep everyone on their toes.

I’ve had friends ask me why their antivirus didn’t stop a phishing email, or why a firewall alone wasn’t enough. The answer often comes down to understanding that security isn’t a single tool—it’s a mix of controls working together. Let’s break it down.

Cybersecurity controls protecting systems, networks, and data

🧩 Detailed Explanation

Security controls are measures or mechanisms put in place to reduce risks to a system or organisation. They help prevent, detect, or respond to threats. You’ll find them in three main categories:

🛡️ 1. Physical Controls

These protect the tangible stuff—buildings, hardware, people.

  • Locks, fences, and security guards
  • CCTV cameras and motion sensors
  • Biometric access (like fingerprint scanners)

These are your first line of defence. If someone can walk into your server room, no amount of software will save you.

💻 2. Technical (Logical) Controls

These are the ones most people think of when they hear “cybersecurity.”

  • Firewalls and intrusion detection systems
  • Encryption and antivirus software
  • Multi-factor authentication (MFA)

They live in the digital realm and are often automated.

📜 3. Administrative Controls

These are the policies, procedures, and training that guide behaviour.

  • Security awareness training
  • Incident response plans
  • Acceptable use policies

They’re not flashy, but they’re crucial. A well-trained team can spot a phishing attempt faster than any tool.

🎯 Types of Security Controls by Function

Controls can also be grouped by what they do:

  • Preventative: Stop an incident before it happens (e.g., firewalls, locks)
  • Detective: Identify when something’s gone wrong (e.g., logs, alarms)
  • Corrective: Fix things after an incident (e.g., backups, patches)
  • Deterrent: Discourage attackers (e.g., warning signs, visible cameras)

Most systems use a mix of all four.

🌍 Real-World Example

Imagine a small clinic. They have:

  • A locked door to the server room (physical)
  • A firewall and encrypted patient records (technical)
  • Staff trained to spot suspicious emails (administrative)

If a phishing email slips through, the firewall might not catch it—but a trained receptionist might. That’s the power of layered controls.

🔑 Key Points

  • Security controls are safeguards to protect systems and data.
  • They come in three types: physical, technical, and administrative.
  • They also serve different functions: preventative, detective, corrective, and deterrent.
  • A strong security posture uses multiple layers of controls.
  • No single control is perfect—layering is key.

❓ Knowledge Check

Test your understanding with these questions: