Security Controls - CompTIA Security+ SY0-701 - 1.1

About this video

• Video Title: Security Controls - CompTIA Security+ SY0-701 - 1.1
• Channel: Professor Messer
• Speakers: Professor Messer
• Duration: 00:11:49

Overview

This video provides a foundational understanding of security controls, categorizing them into four types: technical, managerial, operational, and physical. It further breaks down control types into preventive, deterrent, detective, corrective, and directive, explaining each with examples and illustrating how they fit within the broader categories.

Key takeaways

• Four Categories of Security Controls:
  • Technical: Implemented using technology (e.g., firewalls, antivirus software, operating system policies).
  • Managerial: Developed through policies and procedures (e.g., security policies, onboarding procedures).
  • Operational: Implemented by people (e.g., security guards, awareness training, lunch and learns).
  • Physical: Controls access to buildings, rooms, or devices (e.g., fences, locks, badge readers, guard shacks).
• Five Types of Security Controls:
  • Preventive: Limits access to resources (e.g., firewall rules, guard shacks).
  • Deterrent: Discourages potential attackers (e.g., splash screens, threat of demotion).
  • Detective: Identifies breaches after they occur (e.g., system logs, patrols, motion detectors).
  • Corrective: Mitigates the impact of an event (e.g., restoring from backups, contacting law enforcement, fire extinguishers).
  • Compensating: Provides alternative means to control an event when other controls are insufficient (e.g., temporary firewall rules, separation of duties, generators).
  • Directive: Guides behavior towards more secure actions (e.g., requiring encrypted folders, compliance policies, "authorized personnel only" signs).
• Control Mapping: The video demonstrates how specific security measures can be mapped to both a category (technical, managerial, operational, physical) and a type (preventive, deterrent, detective, corrective, directive). For instance, a firewall rule is a technical preventive control, while a guard shack is a physical preventive control.
• Evolving Landscape: The effectiveness and categorization of controls can change with evolving technology and security processes, and implementations may vary between organizations.