I know that security controls are divided into three categories, namely technical, management and operational. Going through them I always felt as a though a control belonging to one of the above categories can belong to an other as well. For example, i feel as though separation of duties can be classified as a management and an operational control. Hence, i wanted to know firstly, if am right or wrong in thinking so and second, if some can provide examples of overlapping security controls.

1 Answer 1


You are absolutely correct in your first question that security controls can be categorized in many different manners, and that a particular security control could possibly fall into several of those categorizations.

There is no absolute universally agreed-to set of categories either, some are older categorizations that made sense in the 1990s and 2000s, and newer categorizations have evolved to address contemporary defense strategies against threats. The Wikipedia article on Security Controls lists two categorization schemes: {Physical, Procedural, Technical, Legal} and {People, Technology, Operations}. The IS Handbook shows another set {Admin, Logical, Physical}. And you can google to find even more opinions about how to categorize security controls.

I would suggest however that you not get too hung up on security control categories in the first place. They are too high level, and not very helpful in actual design and development of a security solution for a particular system. How they are helpful is in reminding you (the security professional) that security controls are more than just technical.

A good security solution that achieves an acceptable level of residual risk is one that has a diversity of overlapping controls, that draw from ongoing security insights from talented humans and from rout operational procedures (from those humans with less talent) in addition to security technologies. However too many security professionals just focus on the latest technical security toys, yet forget to lock the door to the network closet (to cite a trivial example).

[One side note, if you are studying for a professional credential or a security class, then no matter what you might think otherwise, to pass you will need to parrot that credential's or class' definition of categories, and where they place security controls within those categories.]

For your second amplifying question, some examples of notional security controls that may fit multiple classifications that I can think of off the top of my head:

  • "Ensure doors to computer equipment rooms are locked": this is both management/physical (the locks have to be installed on the doors), and procedural/operational (a human needs to check the locks on an on-going basis typically daily).
  • "Audit Logs of Security Critical Events are to be reviewed immediately": this is both technical (some software or hardware has to generate those logs) and procedural/operational (a human needs to ultimately review the events and decide a course of action).
  • "Admins with access to sensitive database servers shall undergo periodic background checks": management (sets up an HR security infrastructure and funds/staffs it), procedural/operational (HR staff has to periodically do these checks), technical (most background checks are now performed via online services).
  • "Boundary Routers shall be configured to perform Network Intrusion Detection": technical (the router hardware and its software), and operational/procedural (someone not only has to configure the router properly the first time, that configuration has to be audited periodically because admins unfortunately make undocumented and non-appropriate changes to router configuration "on-the-fly").

I'm sure that other responders can suggest many more examples.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .