When looking at the Certified Information Systems Auditor (CISA) exam, we focus on teaching 3 types of controls:
- Preventative – keeps an incident from occurring
- Detective – Identifies the occurrence of an event and possibly the actor
- Corrective – Fixes things after the incident
However, the Certified Information System Security Professional (CISSP) indicates there are also 3 types of controls, but they are different than the ones listed as “types” by the CISA:
- Administrative – These are management type of controls. They are also known as soft controls and sometimes folks call these manual procedures.
- Technical – Also, logical. These are controls we attribute to software and hardware.
- Physical – Controls that protect the physical environment such as guards, locks, fences, and cameras.
So what does the CISSP do with the 3 listed by the CISA? Those are called control functionalities. There are 6 of those:
- Preventative
- Detective
- Corrective
- Deterrent – A control intended to discourage an attacker.
- Recovery – A control which returns the environment back to normal operations.
- Compensating – A control that provides an alternative means when another control isn’t/can’t be used.
In the CISA we often talk about compensating controls but we don’t list them as a specific functionality. However, I like the CISSP breakdown a lot better. Basically, we get a matrix between the 3 types and the first 5 functionalities, with compensating controls being understood to protect an asset when the primary control is unavailable or too costly.
The key takeaway is to understand how our controls are implemented and why they work. Classification helps us better understand what we’ve got protection-wise and it will allow us to spot gaps.