Listen to this Post
Introduction:
In the ever-evolving landscape of cybersecurity, understanding “Security Controls” is the foundational step toward building a resilient defense architecture. As highlighted in a recent breakdown by Bastien Biren, CISSP, these controls are not just technical jargon but practical measures—ranging from firewalls to company policies—that mitigate risk. For professionals preparing for the CISSP exam or hardening an enterprise environment, grasping the difference between a control’s category (where it operates) and its type (its function) is critical. This guide expands on those concepts, providing actionable steps to implement and verify these controls across Linux, Windows, and cloud environments.
Learning Objectives:
- Distinguish between Administrative, Technical, and Physical control categories.
- Map specific security tools and commands to the seven control types (Preventive, Detective, Corrective, etc.).
- Implement and verify common security controls using native Linux and Windows commands.
- Understand how compensating controls work in cloud and hybrid infrastructures.
You Should Know:
1. Deconstructing Control Categories: Where Security Lives
Security controls are classified by their nature or location. An organization must balance all three categories to create a robust defense-in-depth strategy.
Step‑by‑step guide to identifying and implementing category-specific controls:
A. Administrative Controls (The Policy Layer)
These are the rules and frameworks governing human behavior.
– What it does: Reduces risk through process, not technology.
– Implementation:
1. Develop a Policy: Draft an Acceptable Use Policy (AUP) defining how employees use company assets.
2. Training: Mandate Security Awareness Training covering phishing and password hygiene.
3. Verification (Linux/Windows): While these are document-based, you can verify user acknowledgment by checking log files.
– Linux: Check if users have read the policy by auditing login records and correlating with training completion logs stored in a `SQLite` database.
sqlite3 training.db "SELECT user, completion_date FROM training WHERE course='AUP_2026' AND status='Pass';"
– Windows (PowerShell): Search network shares for signed policy documents.
Get-ChildItem -Path "\CompanyShare\Policies\" -Recurse | Where-Object {$_.Name -like "AUP"}
B. Technical Controls (The System Layer)
These are hardware/software mechanisms protecting assets.
- What it does: Enforces policy via technology (Firewalls, MFA, Encryption).
- Implementation (Firewall – Preventive):
- Linux (iptables): Block incoming traffic from a suspicious IP.
sudo iptables -A INPUT -s 203.0.113.45 -j DROP sudo iptables -L -v -n | grep 203.0.113.45
- Windows (Firewall): Block an outbound port using
netsh.netsh advfirewall firewall add rule name="Block_Outbound_445" dir=out action=block protocol=TCP remoteport=445
C. Physical Controls (The Perimeter Layer)
These controls prevent physical access.
- What it does: Protects hardware and facilities (Locks, Biometrics, CCTV).
- Implementation: While hardware is tangible, verification involves checking system logs for physical access events.
- Windows Security Log: Check for Event ID 4800 (Workstation locked) and 4801 (Workstation unlocked) to verify badge access patterns.
Get-EventLog -LogName Security -InstanceId 4800 -Newest 10 | Format-Table TimeGenerated, Message
- Mapping Control Types: The “What” of the Control
The Control Type defines the action a control performs during an attack lifecycle.
Step‑by‑step guide to configuring controls by type:
A. Preventive vs. Detective (Firewall & SIEM)
- Firewall (Preventive): Aims to stop the attack.
- Windows Defender Firewall: Enable logging to see what was blocked.
netsh advfirewall set currentprofile logging filename %systemroot%\system32\LogFiles\Firewall\pfirewall.log
- SIEM (Detective): Aims to find the breach.
- Linux (Rsyslog + Log Analysis): Configure your Linux host to send logs to a central SIEM (like Wazuh or Splunk).
Edit rsyslog config to forward logs echo ". @192.168.1.100:514" >> /etc/rsyslog.conf systemctl restart rsyslog
- Verification: Use `tcpdump` to confirm logs are leaving the host.
sudo tcpdump -i eth0 host 192.168.1.100 and port 514
B. Corrective and Recovery (Incident Response)
- Corrective (Restoring Integrity): Actions taken during/after an incident.
- Linux: Restore a compromised configuration file from a secure backup.
sudo cp /backup/ssh/sshd_config.clean /etc/ssh/sshd_config sudo systemctl restart sshd
- Recovery (Business Continuity): Restoring operations after a disaster.
- Windows (Backup): Use `wbadmin` to recover system state.
wbadmin get versions wbadmin start systemstaterecovery -version:MM/DD/YYYY-HH:MM
- Compensating Controls: When You Can’t Have the Ideal
Sometimes you cannot implement a primary control (e.g., you can’t patch a legacy system). A compensating control provides equivalent protection.
Step‑by‑step guide to implementing compensating controls:
- Scenario: A legacy Windows Server 2008 must remain online but cannot be patched against a specific SMB vulnerability.
- Primary Control: Missing patch (Corrective).
- Compensating Controls (Technical):
- Network Segmentation: Isolate the server on a separate VLAN.
- Strict Firewall Rules (Windows Firewall): Block all inbound SMB traffic (ports 139, 445) except from specific admin workstations.
netsh advfirewall firewall set rule name="File and Printer Sharing (SMB-In)" new enable=No netsh advfirewall firewall add rule name="Compensating_Admin_SMB" dir=in action=allow protocol=TCP localport=445 remoteip=192.168.20.50
- Monitoring (Detective): Enable advanced auditing to trigger alerts on any SMB connection attempt.
auditpol /set /subcategory:"File System" /success:enable /failure:enable
4. API Security as a Technical Control
Modern applications rely on APIs. Implementing controls here is non-negotiable.
Step‑by‑step guide to hardening an API:
- Preventive (Rate Limiting): Use a gateway like Nginx to prevent brute-force attacks.
In nginx.conf limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s; server { location /api/ { limit_req zone=mylimit burst=20 nodelay; proxy_pass http://api_backend; } } - Detective (Logging): Ensure the API logs all 401 (Unauthorized) and 403 (Forbidden) errors.
– Linux: Monitor the access log for attack patterns.
tail -f /var/log/nginx/access.log | grep " 401 | 403 "
5. Cloud Hardening (Technical & Administrative)
In cloud environments, controls often merge.
Step‑by‑step guide to implementing a Detective Control in AWS:
1. Objective: Detect a misconfigured S3 bucket (Technical Detective Control).
2. Action: Enable AWS Config and create a rule to check for public read access.
– CLI Command:
aws configservice put-config-rule --config-rule file://s3-public-read-prohibited.json
3. Verification: Manually check a bucket’s ACL.
aws s3api get-bucket-acl --bucket your-company-data-bucket
6. Vulnerability Exploitation & Mitigation (Hands-on)
Understanding how controls are bypassed helps in fortifying them.
Scenario: Bypassing a weak “Preventive” control.
- Weak Control: A Web Application Firewall (WAF) that only blocks `’ OR 1=1–` (basic SQLi).
- Exploitation: An attacker uses an encoded payload to bypass the regex.
Payload bypassing simple WAF /product?id=1%20UnIoN%20SeLeCt%201,2,3--
- Mitigation (Corrective/Preventive):
1. Hardened Code (Parameterized Queries): In Python/Flask.
Vulnerable code
cursor.execute(f"SELECT FROM products WHERE id = {user_input}")
Mitigated code (Preventive)
cursor.execute("SELECT FROM products WHERE id = ?", (user_input,))
2. WAF Update (Corrective): Update WAF rules to decode payloads before inspection.
What Undercode Say:
- Key Takeaway 1: Security is not just a technology problem. The interplay between Administrative (policy), Technical (tools), and Physical (access) controls creates the holistic defense required for modern compliance frameworks like ISO 27001 and NIST. Neglecting one category creates a blind spot regardless of how advanced the others are.
- Key Takeaway 2: The function of a control (Preventive, Detective, Corrective) dictates its place in the incident response lifecycle. While prevention is ideal, investment in detective and corrective controls is equally vital because breaches are inevitable. A robust SIEM configuration (Detective) combined with a well-rehearsed backup recovery plan (Corrective) defines organizational resilience.
Analysis:
Bastien Biren’s breakdown simplifies a dense domain of the CISSP Common Body of Knowledge (CBK). By applying these concepts to concrete commands—like using `iptables` for prevention or `auditpol` for detection—we bridge the gap between theory and practice. In a real-world scenario, a security architect must constantly map new tools back to these fundamentals. For instance, when deploying an EDR solution, one must ask: “Is this a Preventive control (blocking execution) or a Detective control (alerting on behavior)?” Understanding this taxonomy prevents tool sprawl and ensures a balanced security posture. Furthermore, the concept of compensating controls is critical in legacy and cloud-native hybrid environments, where ideal configurations are often impossible, requiring creative, multi-layered defenses.
Prediction:
As we move toward AI-driven security operations, the classification of controls will evolve. We will likely see the rise of “Autonomous Controls”—a hybrid of Detective and Corrective—where AI detects a threat and automatically deploys a virtual patch or isolates a host without human intervention. This will blur the lines between Control Types, requiring security professionals to master the logic and rules governing these automated systems. The foundational knowledge of control categories, however, will remain the bedrock upon which these intelligent systems are designed and audited.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Biren Bastien – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
