Study guide
2.2 Confidentiality, Integrity & Availability Controls
Cisco CCST Cybersecurity Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Introduction & Exam Strategy
1.1 About the Cisco CCST Cybersecurity Exam 1.2 Study Roadmap & Preparation Strategy
2 Chapter 2: Essential Security Principles
2.1 Information Security Principles & The CIA Triad 2.2 Confidentiality, Integrity & Availability Controls 2.3 Authentication, Authorization & Accounting (AAA) 2.4 Social Engineering & Human Vulnerabilities 2.5 Security Principles & Access Management 2.6 Encryption, Hashing, Certificates & PKI
3 Chapter 3: Basic Network Security Concepts
3.1 Network Architecture & The OSI/TCP-IP Models 3.2 Network Defense Infrastructure & Firewalls 3.3 Intrusion Detection & Prevention Systems (IDS/IPS) 3.4 Virtual Private Networks & Encryption Protocols 3.5 Network Segmentation, DMZ & Access Control Lists 3.6 Secure Network Protocols & Services
4 Chapter 4: Endpoint Security Concepts
4.1 Endpoint Protection & Host-Based Defense 4.2 Operating System Hardening & Security Baselines 4.3 Patch Management & Vulnerability Remediation 4.4 Mobile Device Management (MDM) & BYOD Security 4.5 Endpoint Detection & Response (EDR) & Compliance 4.6 Endpoint Assessment Tools & Malware Removal
5 Chapter 5: Vulnerability Assessment & Risk Management
5.1 Risk Assessment & Risk Management 5.2 Vulnerability Scanning & Penetration Testing 5.3 CVSS Scoring & Threat Intelligence 5.4 Business Continuity & Disaster Recovery
6 Chapter 6: Incident Handling & Response
6.1 NIST Incident Response Lifecycle & Frameworks 6.2 Incident Containment, Eradication, & System Recovery 6.3 Digital Forensics Fundamentals & Evidence Preservation 6.4 Post-Incident Activity & Compliance Reporting 6.5 SOC Operations, Log Triage, & Event Monitoring 6.6 Attack Attribution: Cyber Kill Chain, MITRE ATT&CK & Diamond Model
2.2 Confidentiality, Integrity & Availability Controls
Key Takeaways Explain This Topic AI
Security controls are safeguards classified by implementation mechanism into Technical (Logical), Administrative (Managerial), and Physical categories.
Functional control classifications define their operational objective: Deterrent, Preventive, Detective, Corrective, Compensating, and Directive.
Defense-in-Depth deploys layered, overlapping safeguards across perimeter, network, endpoint, application, and data boundaries to eliminate single points of failure.
The Principle of Least Privilege (PoLP) and Need-to-Know restrict access permissions to the absolute minimum necessary for an entity's explicit duties.
Zero Trust Architecture (ZTA) replaces perimeter-based implicit trust with the core doctrine: 'Never Trust, Always Verify', requiring continuous authentication and micro-segmentation.
Last updated: August 2026
2.2 Confidentiality, Integrity & Availability Controls
Quick Answer: Security Controls are the technical mechanisms, administrative policies, and physical safeguards deployed to protect organizational infrastructure, minimize risk, and enforce the CIA Triad. Controls are categorized by Implementation Type (Technical, Administrative, Physical) and by Functional Purpose (Deterrent, Preventive, Detective, Corrective, Compensating, Directive). Modern security design structures these controls into layered frameworks such as Defense-in-Depth and Zero Trust Architecture .
To translate high-level security objectives into operational defenses, cybersecurity teams utilize standardized security control taxonomies. Understanding how different control types function independently and complement each other is essential for designing resilient enterprise environments.
Categorization by Implementation Type
Implementation categories describe how a security safeguard is constructed, operated, and enforced:
1. Technical (Logical) Controls
Hardware mechanisms, software applications, operating system configurations, and firmware logic executed directly by IT systems to enforce security rules automatically without human intervention.
Next-Generation Firewalls (NGFW) & Access Control Lists (ACLs): Inspecting and filtering network packets based on IP addresses, port numbers, and application protocols.
Intrusion Prevention Systems (IPS): Inline network appliances that analyze traffic signatures and actively drop malicious packets.
Endpoint Detection and Response (EDR): Software agents installed on endpoints that monitor process execution, detect malware, and isolate compromised hosts.
Cryptographic Encoders: Full-disk encryption (BitLocker, FileVault) and transport encryption (TLS 1.3, IPsec VPNs).
2. Administrative (Managerial) Controls
Executive management policies, procedural guidelines, operational workflows, legal contracts, personnel vetting, and educational programs designed to govern human behavior and organizational operations.
Acceptable Use Policies (AUP): Formal documentation defining mandatory rules for employee usage of corporate IT assets.
Security Awareness Training (SAT): Conducting regular educational sessions and simulated phishing drills to train personnel on human threats.
Separation of Duties (SoD) Policies: Structuring business workflows so that no single employee possesses unchecked administrative power.
Pre-Employment Screening: Conducting background checks and credential verification prior to granting system access.
3. Physical Controls
Tangible, environmental, and structural safeguards designed to restrict physical access to facilities, protect IT hardware from theft or vandalism, and maintain environmental stability.
Perimeter Barriers: Fencing, vehicle bollards, warning signs, and security guards stationed at facility entrances.
Physical Access Barriers: Mantraps (turnstile airlocks), biometric door scanners, electronic badge readers, and locked server racks.
Environmental Protections: Heating, Ventilation, and Air Conditioning (HVAC) systems, Uninterruptible Power Supplies (UPS), clean-agent fire suppression (FM-200 / Novec 1230), and water leak detectors.
Categorization by Functional Objective
Functional classifications describe what objective a safeguard accomplishes during a security event lifecycle: [ Security Event Timeline ]
- BEFORE ATTACK DURING ATTACK AFTER ATTACK
- --------------------------------------------------------------------------------------
- [ Deterrent Controls ] [ Preventive Controls ] [ Corrective Controls ]
- (Discourage attempt) (Block execution) (Remediate damage)
- [ Directive Controls ] [ Detective Controls ] [ Compensating Controls ]
- (Mandate compliance) (Identify & Alert) (Alternative safeguard)
- Functional Category Breakdown
Deterrent Controls: Safeguards designed to discourage potential threat actors from attempting a breach by highlighting consequences or increasing perceived difficulty.
Examples: Warning banners on SSH login screens, warning signs posted around perimeter fences, visible CCTV surveillance cameras.
Preventive Controls: Active safeguards that block, prevent, or stop unauthorized access attempts before they succeed.
Examples: Firewall dropping unauthorized inbound ports, biometric door locks denying unbadged personnel, MFA prompts blocking unauthorized logins.
Detective Controls: Safeguards that monitor, record, and identify unauthorized activity or security breaches during or after occurrence.
Examples: Network Intrusion Detection Systems (NIDS) generating alerts, Security Information and Event Management (SIEM) log correlation rules, File Integrity Monitoring (FIM) agents.
Corrective Controls: Safeguards deployed to repair damage, restore system functionality, and remediate vulnerabilities following a security incident.
Examples: Restoring corrupted systems from clean off-site backups, running automated EDR quarantine scripts, re-imaging compromised operating systems.
Compensating Controls: Alternative safeguards implemented when a primary security control is technically unfeasible or cost-prohibitive.
Examples: Placing an unpatchable legacy Windows 7 medical machine on an isolated VLAN with strict firewall ACLs because the OS cannot be patched.
Directive Controls: Safeguards that direct human behavior to comply with explicit security regulations or organizational policies.
Examples: Written clean desk policies mandating locking documents in drawers, corporate password complexity guidelines.
Cross-Category Security Control Matrix
Security controls work synergistically across implementation types and functional objectives. The matrix below demonstrates how controls intersect:
Functional Objective Technical Implementation Administrative Implementation Physical Implementation
Deterrent Legal warning banner on RDP terminal Mandatory policy notice on security violations Warning signs on high-voltage perimeter fence
Preventive Next-Gen Firewall dropping malicious IP Background checks for administrative hires Biometric mantrap access scanner
Detective SIEM automated correlation alert Mandatory monthly security access audit Motion sensors in server room
Corrective Automated EDR malware isolation script Incident Response Playbook execution Discharging FM-200 gas during server fire
Compensating Micro-segmenting legacy OT on isolated VLAN Dual-signature authorization for legacy app Guard escort for un-badged contractors
Directive Enforcing mandatory password complexity via GPO Acceptable Use Policy (AUP) documentation Floor markings pointing to emergency exits
Core Security Architectural Principles
Building a resilient enterprise network requires adhering to established architectural principles that limit attack surfaces and mitigate risk.
1. Defense-in-Depth (Layered Security)
Recognizing that no single security control is 100% effective, Defense-in-Depth deploys multiple overlapping safeguards across physical, network, host, application, and data layers. If an attacker bypasses the perimeter firewall, they must still breach an inline IPS, bypass endpoint host security, defeat access controls, and overcome strong data encryption. Layering controls eliminates single points of security failure.
2. Principle of Least Privilege (PoLP) & Need-to-Know
Users, system processes, and service accounts should be granted only the minimum access permissions strictly necessary to perform their assigned duties—and no more. Extending excessive administrative rights increases exposure if credentials are compromised. Need-to-Know further restricts access to specific sensitive files even if a user holds high security clearance.
3. Separation of Duties (SoD) & Dual Control
High-risk administrative tasks are split across multiple individuals so that no single user possesses end-to-end control over a critical transaction. For example, a developer who writes application code must not have permission to deploy code directly into production servers. Dual Control requires two authorized individuals to simultaneously execute a sensitive action (such as key ceremony operations or major wire transfers).
4. Zero Trust Architecture (ZTA)
Traditional perimeter defense relied on implicit trust: "Trust everything inside the corporate intranet, distrust outside." Zero Trust replaces this with a strict core doctrine defined in NIST SP 800-207: "Never Trust, Always Verify." Every access request—regardless of whether it originates inside or outside the network perimeter—must be explicitly authenticated, authorized, and cryptographically verified based on user identity, device health posture, and dynamic contextual attributes before access is granted.