Security Controls: Categories and Functions

Lesson plan

Level

Beginner

Time

About 80 minutes; the steps below add up to 78

Learners sort six everyday controls in their own way and usually find two different groupings: by how a control works and by what it does. Those become the lesson's two questions, category and functional type, before either is named. A camera that cannot stop a thief seeds the misconception about CCTV early. Predictions then precede the effect of MFA on a risk, which part of a password regime is managerial, the order of preventive, detective and corrective controls, and what could stand in for MFA on a legacy system; checks apply each list to new cases. The habit to build: describe any control with both questions, answered separately.

Objectives

• Explain what a security control is, and that it reduces risk rather than removing it
• Classify a control by category: managerial, operational, technical or physical
• Classify a control by functional type: preventive, detective, corrective, directive, deterrent or compensating
• Describe any control by both questions at once
• Recognise which control model a document uses before applying its labels

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Defence in Depth lesson first.
• Print or write the six controls from the opening on cards, so that groups can physically sort them.
• The lesson takes about 78 minutes. To teach it in two parts, stop after “Functional types: what a control does”; the second part opens with “Classifying a control both ways”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain what a security control is, and that it reduces risk rather than removing it
   • Classify a control by category: managerial, operational, technical or physical
   • Classify a control by functional type: preventive, detective, corrective, directive, deterrent or compensating
   • Describe any control by both questions at once
   • Recognise which control model a document uses before applying its labels

   Purpose: Learners sort six everyday controls in their own way and usually find two different groupings: by how a control works and by what it does. Those become the lesson's two questions, category and functional type, before either is named. A camera that cannot stop a thief seeds the misconception about CCTV early. Predictions then precede the effect of MFA on a risk, which part of a password regime is managerial, the order of preventive, detective and corrective controls, and what could stand in for MFA on a legacy system; checks apply each list to new cases. The habit to build: describe any control with both questions, answered separately.

2. 1. Sorting six controls Think 6 min

   Purpose: Have learners discover, by sorting, that controls can be grouped by how they work and by what they do.

   Ask

   • Sort the six into groups. What did you group them by?
   • Does the car-park camera stop a thief?

   Responses to expect

   • Groups often mix the two ideas, for example “technology” beside “stops things”. Ask each group to name its rule.
   • Many say yes to the camera. Ask what physically stops a thief who ignores it.
   • On screen in turns: the opening question, its answer; then the question on the car-park camera, and its answer.

   Discussion pause: Let groups compare their sorting rules before revealing the explanation.

   In the lesson window

   • Think it through: Sort the six into groups, in any way that makes sense to you. What did you group them by?
   • Think it through: Does the camera in the car park stop a car thief?

3. 2. What a security control is Explain 8 min

   Purpose: Define threat, vulnerability, risk and control, and show that a control lowers risk without removing it.

   Ask

   • With MFA switched on, is the risk now zero?
   • Which side of the risk does a backup work on?

   Responses to expect

   • Some say zero. Ask whether the attacker still exists and whether MFA can be tricked.
   • On impact: the backup does nothing to stop the attack, but limits the damage.
   • On screen in turns: the opening; then threat, vulnerability and risk, starting with threat; vulnerability; risk; what a security control is; the question on whether MFA makes the risk zero, and its answer; why a control reduces risk rather than removing it; what a control changes: the stolen password, before and after MFA; controls on either side of a risk.

   Misconceptions to challenge

   • A learner may believe: “A control removes the risk.” Respond: It lowers likelihood, impact or both; the threat usually remains.

   In the lesson window

   • Think it through: An attacker has stolen the password to an account that relies on a password alone. The organisation then switches on multi-factor authentication. Is the risk now zero?

4. 3. Two questions about every control Explain 6 min

   Purpose: Name category and functional type, using the learners' two groupings and the classifier diagram.

   Ask

   • Which of your groupings was by category, and which by function?

   Responses to expect

   • Most groups did one of each, or a mixture; that mixture is exactly the mistake the lesson warns against.
   • On screen in turns: the opening; then category and functional type; the two questions as a diagram.

5. 4. Categories: how a control is implemented Predict 12 min

   Purpose: Teach the four categories, the stadium analogy, the test for choosing one, and misleading wording.

   Ask

   • Which part of the password regime is managerial?
   • The USB rule mentions encryption. Which category is the rule?

   Responses to expect

   • Many pick the system that enforces the rule; ask what decision lies behind it.
   • “Technical” is tempting because of the word; ask what the rule itself does.
   • On screen in turns: the opening question, its answer; then the four categories, starting with managerial; operational; technical; physical; what managerial does and does not mean; the football-stadium analogy; choosing the category; the check question on the USB rule, and its answer; descriptions that point the wrong way, with the better answers held back; the better answer for each, and why; a limit of any classification.

   Misconceptions to challenge

   • A learner may believe: “Managerial controls are the managers.” Respond: The category is the governance mechanism, such as a policy, not the people.

   Discussion pause: In the table of misleading descriptions, the better answers are held back: let the class answer each row first.

   If the explanation does not land: Use the stadium: the club board's rule, the steward, the camera system, the turnstile.

   To go further

   • Find a control that genuinely sits across two categories, and say which emphasis you would choose and why.

   In the lesson window

   • Think it through: A company handles passwords in three ways. Which of them is the managerial part?
   • Check your understanding: The staff handbook says that USB sticks must be encrypted. The word “encrypted” suggests technology. Which category is the handbook rule?

6. 5. Functional types: what a control does Predict 12 min

   Purpose: Teach the six functional types, the timeline for three of them, the directive and deterrent distinction, and compensating controls.

   Ask

   • In what order do stopping, noticing and putting right act around an incident?
   • The screen-lock poster: directive or deterrent?
   • What could stand in for MFA on the legacy system?

   Responses to expect

   • The order is usually found quickly.
   • Some say deterrent because it is a warning. Ask whether it threatens any consequence.
   • Learners often suggest “more security” in general; insist that each answer stands in for MFA specifically.
   • On screen in turns: the opening question, its answer; then the six functional types as a diagram; before, during and after; directive, deterrent and compensating; directive and deterrent compared; the check question on the lock-your-screen poster, and its answer; a legacy system without MFA, and the question, and its answer; possible compensating controls; what a compensating control is not.

   Misconceptions to challenge

   • A learner may believe: “Preventive, detective and corrective are categories.” Respond: They are functional types; categories answer a different question.
   • A learner may believe: “A compensating control is any additional control.” Respond: It substitutes for a specific control that cannot be used.

   In the lesson window

   • Think it through: Some controls stop an incident, some notice it, and some put things right. In what order around an incident do those three act?
   • Check your understanding: A poster in the office says: “Lock your screen whenever you leave your desk.” Directive or deterrent?
   • Think it through: The legacy system cannot have MFA. What else could make it unlikely that a stolen password leads to misuse of that system?

7. 6. Classifying a control both ways Check 8 min

   Purpose: Apply both questions to familiar controls, including one with two functions.

   Ask

   • Describe the shredder with both questions.
   • When does the badge-controlled door become detective as well?

   Responses to expect

   • “Corrective” is a common wrong guess for the shredder; ask when it acts.
   • On screen in turns: the opening; then six controls to classify both ways, with the answers held back; the category, function and reasoning for each; why some sources class cameras differently; describing the badge reader both ways, up to its first function; the second function, and the sentence; two habits that help; the check question on the shredder, and its answer.

   Misconceptions to challenge

   • A learner may believe: “CCTV prevents break-ins.” Respond: It discovers and discourages; it does not physically stop anyone.

   Discussion pause: The classification table is held back after the control names: pairs classify each control both ways before the answers appear.

   In the lesson window

   • Check your understanding: An HR office keeps a cross-cut shredder for confidential paper. How would you describe it using both questions?

8. 7. Administrative, managerial and management controls Explain 5 min

   Purpose: Show that different models divide controls differently, and that the model in use decides the label.

   Ask

   • Training: administrative or operational? What do you need to know first?

   Responses to expect

   • Which model the question or document uses.
   • On screen in turns: the opening; then administrative controls; three ways of dividing controls; the practical rule: check the model in use.

   If the explanation does not land: Like units of measure: a distance is the same whether given in miles or kilometres. The control is the same; the model decides its label.

9. 8. How this fits with defence in depth Explain 4 min

   Purpose: Map the four functions of defence in depth onto the six functional types.

   Ask

   • Which of the six types has no equivalent in defence in depth's list?

   Responses to expect

   • Three of the six have no counterpart there: directive, deterrent and compensating.
   • On screen in turns: the opening; then the two vocabularies side by side; why neither list is more correct; describing a control at work in one sentence.

   Misconceptions to challenge

   • A learner may believe: “Defence in Depth and this lesson contradict each other.” Respond: They are two vocabularies for the same job: preventive and preventative are the same, and corrective covers response and recovery.

10. 9. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The pharmacy sign tests two functions in one control; the guard's log tests compensating.
    • On screen in turns: the opening question, its answer; then the question on the handwritten log, and its answer.

    In the lesson window

    • Apply it: A sign on a hospital’s pharmacy store reads: “Authorised staff only. Every entry is recorded.” Which functional types does the sign serve?
    • Apply it: Policy requires a record of everyone who enters the server room, but the old door-entry system cannot record entries. A guard now writes down every entry by hand. What is the guard’s log?

11. 10. Check your understanding Check 10 min

    Purpose: Check the lesson against the approved revision-bank questions on categories and on functional types.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • Several questions are multiple-select; remind learners to choose every answer that applies.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; the next group of revision questions, starting with its first; the second revision question; the third revision question; the fourth revision question; the fifth revision question; the sixth revision question; the seventh revision question; where to practise next.

12. 11. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: describe a locked door with both questions.

    Responses to expect

    • Physical and preventive: an object that stops entry.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

13. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Controls lower likelihood or impact; the threat usually stays.
    • How is it implemented? Managerial, operational, technical or physical.
    • What does it do? Preventive, detective, corrective, directive, deterrent or compensating.
    • Answer the two questions separately; a control may have more than one function.
    • Labels depend on the model, so check which one is in use.

Consolidation

• Controls lower likelihood or impact; the threat usually stays.
• How is it implemented? Managerial, operational, technical or physical.
• What does it do? Preventive, detective, corrective, directive, deterrent or compensating.
• Answer the two questions separately; a control may have more than one function.
• Labels depend on the model, so check which one is in use.