Use the CIA triad to describe what a control protects, and classify controls by category and type.
Why it matters
Security teams spend money and time on controls: anything that reduces risk, from a firewall rule to a locked door to a policy. To decide which controls a system needs, and to talk about them clearly with auditors, managers and other engineers, you need a shared vocabulary. The CIA triad and the standard control categories and types are that vocabulary. They also appear on almost every entry-level security exam.
The CIA triad
Every security goal maps onto one or more of three properties:
- Confidentiality: only authorised people can read the data. Threats: data leaks, eavesdropping, a lost unencrypted laptop. Controls: access control, encryption, data classification.
- Integrity: data and systems are accurate and have not been changed without authorisation. Threats: tampering, malware, accidental edits. Controls: hashing and digital signatures, change control, input validation, backups to restore a known-good state.
- Availability: systems and data are there when authorised people need them. Threats: outages, ransomware, denial-of-service attacks, hardware failure. Controls: redundancy, backups, capacity planning, patching, DDoS protection.
The three often pull against each other. Encrypting everything with keys held by one person helps confidentiality but hurts availability if that person is away. Good design balances them for the data in question: a hospital's patient records need high availability as well as confidentiality, while a public website needs integrity and availability far more than confidentiality.
Many frameworks add related ideas such as authenticity (data really comes from who it claims) and non-repudiation (someone cannot later deny an action, usually provided by digital signatures and audit logs).
Control categories: who or what carries out the control
| Category | Description | Examples |
|---|---|---|
| Technical | Implemented by systems and software | Firewalls, MFA, encryption, antivirus, logging |
| Managerial | Decisions and oversight by management | Risk assessments, security policies, vendor reviews |
| Operational | Carried out day to day by people | Security awareness training, guard patrols, change procedures |
| Physical | Protect the physical world | Door locks, badges, fences, CCTV, server room cages |
Control types: what the control does
| Type | Goal | Examples |
|---|---|---|
| Preventive | Stop an incident before it happens | Firewall deny rule, MFA, door lock |
| Detective | Notice an incident during or after | Intrusion detection, log alerts, CCTV review |
| Corrective | Limit damage and restore normal operation | Restoring from backup, patching after an exploit, isolating an infected host |
| Deterrent | Discourage an attacker from trying | Warning banners, visible cameras, "this area is monitored" signs |
| Compensating | An alternative when the usual control cannot be used | Extra monitoring and network isolation for an old system that cannot be patched |
| Directive | Tell people what to do | Policies, procedures, "visitors must sign in" signs |
A control has one category and one or more types. A security camera is a physical control; it is deterrent when visible and detective when someone reviews the footage.
Defence in depth
No single control is perfect, so defenders layer them. If one fails, another still stands. For a company laptop:
- Preventive, technical: full-disk encryption, MFA on login, automatic patching.
- Detective, technical: endpoint detection software reporting to the security team.
- Corrective, technical: remote wipe and restore from backup.
- Directive and operational: a policy and training on locking the screen and reporting loss quickly.
Losing the laptop on a train is now an inconvenience, not a data breach.
Worked example: classifying controls
A small accounting firm lists its controls. Classify each one:
| Control | Category | Type | Mainly protects |
|---|---|---|---|
| Nightly backups kept offline | Technical | Corrective | Availability, integrity |
| Staff must use a password manager (written policy) | Managerial | Directive | Confidentiality |
| Alerts when an account logs in from a new country | Technical | Detective | Confidentiality |
| Server room door needs a badge | Physical | Preventive | Confidentiality, availability |
| Old tax software cannot be patched, so it runs on an isolated network segment with extra logging | Technical | Compensating | All three |
| Login banner: "Unauthorised access is prohibited and monitored" | Technical | Deterrent | Confidentiality |
| Quarterly phishing training | Operational | Preventive | Confidentiality |
Notice the reasoning: the backup cannot stop ransomware from encrypting files, but it fixes the damage afterwards, so it is corrective. The isolated network does not fix the unpatched software, it compensates for the missing patch.
Common mistakes
- Mixing up category and type. Category answers "what kind of thing is it?"; type answers "what does it do in an incident?"
- Only buying preventive controls. Prevention fails eventually. Without detective and corrective controls you will not notice or recover.
- Forgetting availability. Ransomware is an availability attack first. Tested, offline backups are among the most valuable controls a small organisation can have.
- Treating policy as done. A directive control only works if people know it and something checks that they follow it.
Quick recap
- CIA: confidentiality (only the right people read it), integrity (it is accurate and unaltered), availability (it is there when needed).
- Control categories: technical, managerial, operational, physical.
- Control types: preventive, detective, corrective, deterrent, compensating, directive.
- Layer different kinds of controls (defence in depth) so one failure does not become a breach.