Security Controls and Countermeasures

Security controls are the specific measures an organisation puts in place to reduce its exposure to information security risks. They are the practical, operational expression of a security policy: the things that actually happen to protect information, systems and people. Understanding the types of controls available, how they work individually, and how they work together is essential for any manager who wants to think clearly about the security of their team’s environment.

It is important to recognise from the outset that no single control is sufficient on its own. Every control can fail or be circumvented. Effective security relies on multiple overlapping layers of controls working together, so that if one fails, others are in place to limit the damage. Security professionals call this principle defence in depth, and it is one of the most important concepts in information security management.

Types of Security Controls: Classification by Function

The most common way of classifying security controls is by what they are designed to do. There are three primary functional categories:

• Preventive controls: designed to stop an incident from occurring in the first place, or to reduce the likelihood that a threat will successfully exploit a vulnerability. Multi-factor authentication prevents unauthorised account access even when a password has been stolen. Encryption makes data unreadable to anyone without the correct decryption key. Security awareness training reduces the likelihood of a staff member falling for a phishing attack. Access controls limit who can reach sensitive data or systems. Preventive controls are the first line of defence, and they are where most organisations invest the majority of their security effort.
• Detective controls: designed to identify when an incident has occurred, is in progress, or is being attempted. Monitoring systems that alert security teams to unusual patterns of data access or login attempts allow an incident to be identified quickly and contained before it causes serious harm. Audit logs record who accessed which data and when, creating an evidential trail that can be reviewed after an incident or during an audit. Intrusion detection systems flag suspicious network behaviour. Regular access reviews, conducted by managers, can detect when former employees or contractors still have active access they should no longer hold. Detective controls are essential because preventive controls will never be one hundred per cent effective, and the faster an incident is identified, the lower the potential damage.
• Corrective controls: designed to limit the impact of an incident that has already occurred and to restore normal operations as quickly as possible. Incident response procedures define what actions are taken when an incident is detected, who is responsible for each step, and how communication is managed internally and externally. Backup and recovery systems allow data and systems to be restored after a ransomware attack or a hardware failure. Patch management processes address known software vulnerabilities after they have been identified. Corrective controls are the organisation’s ability to recover, and their quality often determines the difference between a contained incident and a catastrophic one.

Types of Security Controls: Classification by Nature

Controls can also be classified by their nature, meaning the means through which they are implemented. ISO 27001:2022 uses four categories:

• Organisational controls: implemented through policies, processes and governance structures. These include information security policies, access management procedures, supplier security requirements, incident management processes, acceptable use policies, security audit programmes and business continuity plans. Organisational controls define the rules and processes within which people and technology operate. They are often the responsibility of management rather than technical teams, and they are frequently the weakest link in an organisation’s security posture when they are poorly documented, not understood or not consistently followed.
• People controls: focused on the human dimension of security. Background checks and vetting for new employees reduce the risk of insider threats. Security awareness training equips staff to recognise and respond to common threats such as phishing, social engineering and password attacks. Clear acceptable use policies define what staff can and cannot do with organisational systems and data. A reporting culture in which staff feel safe flagging mistakes without fear of punishment means that incidents are more likely to be identified and addressed quickly. People controls are directly within a manager’s sphere of influence and are among the most impactful investments an organisation can make.
• Physical controls: protecting the physical environment in which information is processed and stored. Secure server rooms with restricted access, visitor management systems, CCTV, clear desk policies that require staff to secure documents and portable devices when not in use, locked cabinets for sensitive paper records, and screen locks that activate automatically when a device is unattended are all examples of physical controls. Physical controls are sometimes underestimated in an era of digital threats, but a laptop left unattended in a coffee shop or a printed document left on a shared printer can represent as significant a security risk as a sophisticated cyber attack.
• Technological controls: implemented through technology. Multi-factor authentication, firewalls, antivirus and anti-malware software, data encryption, role-based access controls, intrusion detection and prevention systems, vulnerability scanning tools, email filtering systems and security monitoring platforms are all examples of technological controls. These controls are typically the responsibility of IT and security teams, but managers play an important role in ensuring that their team uses them correctly and consistently.

Countermeasures and the Role of Proportionality

A countermeasure is any action taken to reduce a specific risk. The concept of proportionality is central to effective countermeasure selection. Not every risk warrants the same response, and not every control is appropriate in every context. A small organisation processing limited volumes of non-sensitive customer data does not need the same security infrastructure as a hospital processing detailed patient health records. What matters is that the controls in place are proportionate to the sensitivity of the data being protected, the likelihood and potential impact of a breach, and the resources available to the organisation.

For managers, proportionality means making sensible, informed judgements about security in your team’s specific context. It means understanding which data your team handles, how sensitive it is, who has access to it, and what the consequences would be if it were compromised. Armed with that understanding, you are in a much better position to advocate for appropriate controls, identify gaps and make sensible decisions when security and operational convenience come into tension.

A Practical Manager’s Checklist of Controls

The following are examples of security controls that are directly relevant to most management environments and within a manager’s sphere of influence or oversight:

• Access management: ensuring that team members have access only to the systems and data they need for their current role, and that access is reviewed when roles change or when someone leaves the organisation
• Offboarding procedures: ensuring that when a team member leaves, their access to all systems, email accounts, shared drives and third-party platforms is revoked promptly
• Clear desk and screen lock policies: ensuring sensitive documents are secured when not in use and that screens are locked when workstations are unattended
• Incident reporting: ensuring your team knows how to report a suspected phishing email, a lost device, an accidental data disclosure or any other security concern, and that they feel safe doing so
• Approved tools and applications: understanding which tools your team uses and ensuring those tools have been approved by your organisation’s IT or security function
• Supplier and contractor access: knowing which third parties have access to your team’s systems or data, and ensuring that access is limited, monitored and revoked when no longer needed