Types of Security Controls | AP Cybersecurity
Types of Security Controls (and the CIA Triad They Protect)
A security control is a safeguard that reduces risk. Topic 2.1 asks you to identify types of controls. Every control protects at least one goal of the CIA triad: confidentiality, integrity, or availability.
Contents
What controls protect: the CIA triad
Security controls exist to protect at least one part of the CIA triad. Confidentiality means only authorized people can read data. Integrity means data is accurate and unaltered. Availability means data and systems are accessible when needed.
When you evaluate any control, ask which goal it protects. Encryption protects confidentiality; a checksum protects integrity; a backup protects availability.
A company keeps redundant servers so a failure does not take the site offline. Which CIA goal does this protect?
Reveal answer
Availability. Redundancy keeps systems accessible when needed, even if one component fails.
Map the control to the goal: secrecy = confidentiality, accuracy = integrity, uptime and access = availability.
Classifying controls
Controls are classified by type and by function. By type, controls can be managerial (policies and training), technical (software and configuration), or physical (locks and cameras). By function, controls can prevent an attack, detect one, or correct after one.
A single safeguard can fit more than one category. A firewall is a technical control whose function is largely preventive.
Employee security training is which type of control?
Reveal answer
A managerial control. Training is a policy-and-people safeguard rather than a technical configuration or a physical barrier.
The CIA triad in real incidents
A data leak breaks confidentiality, a tampered record breaks integrity, and a ransomware lockout breaks availability. Naming which goal an incident violates guides the right response.
Map each control and each incident to a CIA goal.
Key Terms
| Confidentiality | Only authorized people can read the data. |
| Integrity | Data is accurate and unaltered. |
| Availability | Data and systems are accessible when needed. |
| Managerial control | A policy or training safeguard. |
| Technical control | A software or configuration safeguard. |
Match It Up
Common Mistakes
Forgetting controls map to CIA
Every control protects confidentiality, integrity, or availability; name which.
Mixing confidentiality and integrity
Confidentiality is secrecy; integrity is accuracy. They are different goals.
Calling every control technical
Controls can also be managerial (policy) or physical (locks).
Ignoring function
A control also has a function: prevent, detect, or correct.
Check for Understanding
Frequently Asked Questions
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
Prefer email? Reach me directly at [email protected]