Overview
Security controls are the safeguards you put in place to reduce risk. They are commonly classified two ways: by function (preventive, detective, corrective) and by type (administrative, technical, physical). This lesson covers the first and most intuitive function: preventive controls, which try to stop bad things before they happen.
Learning objectives
- Define a security control and a preventive control.
- Give examples of preventive controls.
- Understand why prevention alone is never enough.
Core concept
A preventive control aims to stop an incident from occurring in the first place. It reduces likelihood. Examples span all three types:
- Technical: firewalls, encryption, MFA, input validation, access controls.
- Administrative: security policies, employee screening, security-awareness training.
- Physical: locks, fences, badge readers, bollards.
Prevention is the first line of defense — cheaper and less painful than cleaning up after an incident.
How it works
Preventive controls raise the effort or block the path an attacker would use. A firewall drops unwanted connections before they reach a service; MFA prevents a stolen password from working; a locked server room prevents physical tampering. Because attackers adapt, prevention is layered (defense in depth) so bypassing one control still meets another.
Practical example
To protect a web application, a team requires MFA (prevents credential-based takeover), validates all input (prevents injection), and puts the database behind a firewall reachable only from the app server (prevents direct external access). Each control blocks a specific attack path before it can succeed.
Cybersecurity relevance
Most "hardening" work is about adding preventive controls. But prevention has a hard limit: no set of preventive controls is perfect, and a determined or lucky attacker will eventually get through one. That is exactly why detective and corrective controls (next lessons) exist — you must assume prevention will sometimes fail.
Common mistakes
- Investing only in prevention and having no way to detect or recover when it fails.
- Assuming a preventive control is flawless (e.g. "we have a firewall, so we're safe").
Key takeaways
- A preventive control stops incidents before they occur, reducing likelihood.
- Preventive controls exist in technical, administrative, and physical forms.
- Prevention is essential but never sufficient alone — it must be paired with detection and recovery.
Check your understanding
- Give one technical, one administrative, and one physical preventive control.
- Why can't an organization rely on preventive controls alone?