2.2 Confidentiality, Integrity & Availability Controls

2.2 Confidentiality, Integrity & Availability Controls

Quick Answer: Security Controls are the technical mechanisms, administrative policies, and physical safeguards deployed to protect organizational infrastructure, minimize risk, and enforce the CIA Triad. Controls are categorized by Implementation Type (Technical, Administrative, Physical) and by Functional Purpose (Deterrent, Preventive, Detective, Corrective, Compensating, Directive). Modern security design structures these controls into layered frameworks such as Defense-in-Depth and Zero Trust Architecture.

To translate high-level security objectives into operational defenses, cybersecurity teams utilize standardized security control taxonomies. Understanding how different control types function independently and complement each other is essential for designing resilient enterprise environments.

Categorization by Implementation Type

Implementation categories describe how a security safeguard is constructed, operated, and enforced:

1. Technical (Logical) Controls

Hardware mechanisms, software applications, operating system configurations, and firmware logic executed directly by IT systems to enforce security rules automatically without human intervention.

• Next-Generation Firewalls (NGFW) & Access Control Lists (ACLs): Inspecting and filtering network packets based on IP addresses, port numbers, and application protocols.
• Intrusion Prevention Systems (IPS): Inline network appliances that analyze traffic signatures and actively drop malicious packets.
• Endpoint Detection and Response (EDR): Software agents installed on endpoints that monitor process execution, detect malware, and isolate compromised hosts.
• Cryptographic Encoders: Full-disk encryption (BitLocker, FileVault) and transport encryption (TLS 1.3, IPsec VPNs).

2. Administrative (Managerial) Controls

Executive management policies, procedural guidelines, operational workflows, legal contracts, personnel vetting, and educational programs designed to govern human behavior and organizational operations.

• Acceptable Use Policies (AUP): Formal documentation defining mandatory rules for employee usage of corporate IT assets.
• Security Awareness Training (SAT): Conducting regular educational sessions and simulated phishing drills to train personnel on human threats.
• Separation of Duties (SoD) Policies: Structuring business workflows so that no single employee possesses unchecked administrative power.
• Pre-Employment Screening: Conducting background checks and credential verification prior to granting system access.

3. Physical Controls

Tangible, environmental, and structural safeguards designed to restrict physical access to facilities, protect IT hardware from theft or vandalism, and maintain environmental stability.

• Perimeter Barriers: Fencing, vehicle bollards, warning signs, and security guards stationed at facility entrances.
• Physical Access Barriers: Mantraps (turnstile airlocks), biometric door scanners, electronic badge readers, and locked server racks.
• Environmental Protections: Heating, Ventilation, and Air Conditioning (HVAC) systems, Uninterruptible Power Supplies (UPS), clean-agent fire suppression (FM-200 / Novec 1230), and water leak detectors.

Categorization by Functional Objective

Functional classifications describe what objective a safeguard accomplishes during a security event lifecycle:

                               [ Security Event Timeline ]
  BEFORE ATTACK                      DURING ATTACK                      AFTER ATTACK
---------------------------------------------------------------------------------------
[ Deterrent Controls ]          [ Preventive Controls ]          [ Corrective Controls ]
  (Discourage attempt)            (Block execution)                (Remediate damage)

[ Directive Controls ]          [ Detective Controls ]           [ Compensating Controls ]
  (Mandate compliance)            (Identify & Alert)               (Alternative safeguard)

Functional Category Breakdown

1. Deterrent Controls: Safeguards designed to discourage potential threat actors from attempting a breach by highlighting consequences or increasing perceived difficulty.
   • Examples: Warning banners on SSH login screens, warning signs posted around perimeter fences, visible CCTV surveillance cameras.
2. Preventive Controls: Active safeguards that block, prevent, or stop unauthorized access attempts before they succeed.
   • Examples: Firewall dropping unauthorized inbound ports, biometric door locks denying unbadged personnel, MFA prompts blocking unauthorized logins.
3. Detective Controls: Safeguards that monitor, record, and identify unauthorized activity or security breaches during or after occurrence.
   • Examples: Network Intrusion Detection Systems (NIDS) generating alerts, Security Information and Event Management (SIEM) log correlation rules, File Integrity Monitoring (FIM) agents.
4. Corrective Controls: Safeguards deployed to repair damage, restore system functionality, and remediate vulnerabilities following a security incident.
   • Examples: Restoring corrupted systems from clean off-site backups, running automated EDR quarantine scripts, re-imaging compromised operating systems.
5. Compensating Controls: Alternative safeguards implemented when a primary security control is technically unfeasible or cost-prohibitive.
   • Examples: Placing an unpatchable legacy Windows 7 medical machine on an isolated VLAN with strict firewall ACLs because the OS cannot be patched.
6. Directive Controls: Safeguards that direct human behavior to comply with explicit security regulations or organizational policies.
   • Examples: Written clean desk policies mandating locking documents in drawers, corporate password complexity guidelines.

Cross-Category Security Control Matrix

Security controls work synergistically across implementation types and functional objectives. The matrix below demonstrates how controls intersect:

Core Security Architectural Principles

Building a resilient enterprise network requires adhering to established architectural principles that limit attack surfaces and mitigate risk.

1. Defense-in-Depth (Layered Security)

Recognizing that no single security control is 100% effective, Defense-in-Depth deploys multiple overlapping safeguards across physical, network, host, application, and data layers. If an attacker bypasses the perimeter firewall, they must still breach an inline IPS, bypass endpoint host security, defeat access controls, and overcome strong data encryption. Layering controls eliminates single points of security failure.

2. Principle of Least Privilege (PoLP) & Need-to-Know

Users, system processes, and service accounts should be granted only the minimum access permissions strictly necessary to perform their assigned duties—and no more. Extending excessive administrative rights increases exposure if credentials are compromised. Need-to-Know further restricts access to specific sensitive files even if a user holds high security clearance.

3. Separation of Duties (SoD) & Dual Control

High-risk administrative tasks are split across multiple individuals so that no single user possesses end-to-end control over a critical transaction. For example, a developer who writes application code must not have permission to deploy code directly into production servers. Dual Control requires two authorized individuals to simultaneously execute a sensitive action (such as key ceremony operations or major wire transfers).

4. Zero Trust Architecture (ZTA)

Traditional perimeter defense relied on implicit trust: "Trust everything inside the corporate intranet, distrust outside." Zero Trust replaces this with a strict core doctrine defined in NIST SP 800-207: "Never Trust, Always Verify." Every access request—regardless of whether it originates inside or outside the network perimeter—must be explicitly authenticated, authorized, and cryptographically verified based on user identity, device health posture, and dynamic contextual attributes before access is granted.