Episode 9: Security Control Types Explained (Part 1) (Domain 1)

Security controls are not only categorized by function, but also by the role they play in the security lifecycle—specifically, whether they are preventive, deterrent, detective, corrective, compensating, or directive. In this first part of a two-part breakdown, we focus on preventive and deterrent controls. Preventive controls are designed to stop threats before they occur, such as through encryption, security awareness training, or access control lists (ACLs). Deterrent controls, on the other hand, aim to discourage malicious behavior by increasing perceived risk, using methods like visible surveillance cameras, signage, and motion-activated lighting. We explain how these control types operate in practical environments, highlight examples from corporate and government settings, and show how they integrate into a larger risk management strategy. Understanding the intent behind each control type gives learners the ability to apply them strategically in real-world architectures.