Security Controls & Attack Surface

Table of Contents

1. What are Security Controls?
2. Types of Security Controls by Function
3. Preventive Controls
4. Detective Controls
5. Corrective Controls
6. Deterrent Controls
7. Compensating Controls
8. Physical vs Technical vs Administrative Controls
9. NIST Control Framework
10. Control Implementation Lifecycle
11. What is Attack Surface?
12. Types of Attack Surface
13. Attack Surface Analysis
14. How to Reduce Attack Surface
15. Relationship: Controls + Attack Surface
16. Real-World Scenarios

What are Security Controls?

Security controls are safeguards or countermeasures designed to protect assets, detect threats, and respond to incidents. They are the practical implementation of security principles.

Simple Definition

Security Controls = Actions, devices, or procedures that reduce security risks.

Why Do We Need Security Controls?

Without controls, every system would be completely exposed:

The Control Mindset

Think of security controls like the safety features of a car:

Types of Security Controls by Function

Security controls are categorized by when and how they act in relation to an incident:

The Security Control Timeline

Before Attack ──────► During Attack ──────► After Attack
      │                      │                      │
      ▼                      ▼                      ▼
┌────────────┐       ┌────────────┐        ┌────────────┐
│ Preventive │       │ Detective  │        │ Corrective │
│ Deterrent  │       │            │        │            │
└────────────┘       └────────────┘        └────────────┘

1. Preventive Controls

What They Do

Preventive controls stop security incidents before they happen — they are your first line of defense.

How They Work

Attacker tries to enter → Preventive Control blocks → Attacker fails
                              │
                              ▼
                     (No incident occurs)

Detailed Examples

Real-World Example: Multi-Layer Prevention

A company implements:

1. Firewall blocks known malicious IPs
2. Email filter catches a phishing email with malware
3. Antivirus on the endpoint blocks the malware if it somehow arrives
4. Least privilege access means even if malware runs, it can't spread

The attack is stopped at multiple levels — defense in depth.

2. Detective Controls

What They Do

Detective controls identify and alert about security incidents as they happen or after they occur — they help you find attacks.

How They Work

Incident occurs → Detective Control detects → Alert sent to security team
                                                  │
                                                  ▼
                                         Investigation begins

Detailed Examples

Detective Control in Action

Time  Scenario                                       Control Used
│
├─ 2:00 AM  Attacker scans company network           IDS detects port scan
├─ 2:05 AM  Attacker tries to log in via SSH         IDS detects brute force
├─ 2:10 AM  Attacker successfully logs in            Audit log records login
├─ 2:15 AM  Attacker downloads customer data         SIEM correlates events
├─ 2:16 AM  Alert sent to security team              SIEM generates alert
└─ 2:20 AM  Security team investigates               Incident response begins

The Importance of Detective Controls

• Preventive controls will eventually fail — no prevention is perfect
• Detective controls minimize damage by finding breaches early
• The average time to detect a breach is 207 days — faster detection saves millions

3. Corrective Controls

What They Do

Corrective controls fix damage and restore normal operations after an incident — they help you recover.

How They Work

Incident occurs → Damage done → Corrective Control activates → Recovery complete

Detailed Examples

The 3-2-1 Backup Rule (Corrective Control)

3 ── Create 3 copies of your data
2 ── Store on 2 different types of media
1 ── Keep 1 copy off-site (or in the cloud)

Example:
├── Copy 1: Original data on your computer
├── Copy 2: External hard drive backup
└── Copy 3: Cloud backup (off-site)

Real-World Example

The Attack: Ransomware encrypts all files on a company's server.

Corrective Controls Activated:

1. Incident Response Plan guides the team through steps
2. Backup system restores files from last night's backup
3. Patch deployment fixes the vulnerability that allowed the attack
4. Business Continuity ensures employees can work while systems restore

Result: Business resumes normal operations within 4 hours.

4. Deterrent Controls

What They Do

Deterrent controls discourage attackers from attempting an attack in the first place — they work on psychology.

How They Work

Deterrent controls don't physically stop attacks — they make attackers think twice:

Attacker considers attack → Sees deterrent → "Not worth the risk" → Moves on

Detailed Examples

Real-World Example

A company displays this banner at login:

"WARNING: This system is for authorized users only. All activities are monitored and logged. Unauthorized access will be prosecuted to the fullest extent of the law."

This alone stops many casual attackers and insider threats.

5. Compensating Controls

What They Do

Compensating controls are alternative safeguards used when the primary control is not feasible, too expensive, or technically impossible.

When Are They Used?

Important Rule for Compensating Controls

A compensating control must be at least as effective as the primary control it replaces.

If the compensating control is weaker, it doesn't truly compensate — it creates a false sense of security.

Real-World Example: Small Business

A small business of 10 employees needs security but has no IT budget:

Primary Control (Ideal): Enterprise SIEM, dedicated SOC team, hardware firewall Compensating Controls:

• Free antivirus (Windows Defender) instead of enterprise EDR
• Cloud-based email filtering instead of on-premise
• Free password manager instead of enterprise SSO
• Owner performs manual log reviews weekly

Result: Not as strong as enterprise security, but significantly better than nothing.

Physical vs Technical vs Administrative Controls

Security controls can also be categorized by how they are implemented:

1. Physical Controls

Tangible, physical barriers that protect assets.

2. Technical (Logical) Controls

Software, hardware, and data-based solutions.

3. Administrative Controls

Policies, procedures, training, and management.

Implementation by Organization Type

NIST Control Framework

The NIST SP 800-53 is one of the most widely used security control frameworks. It organizes controls into families:

Control Implementation Lifecycle

The 5 Stages of Control Implementation

Stage 1: IDENTIFY
         └── What controls do we need? (Risk assessment)
                ↓
Stage 2: SELECT
         └── Choose appropriate controls (NIST, ISO 27001)
                ↓
Stage 3: IMPLEMENT
         └── Deploy the controls (technical + procedural)
                ↓
Stage 4: TEST
         └── Verify controls work as intended
                ↓
Stage 5: MONITOR
         └── Continuously assess effectiveness
                ↓
         (Return to Stage 1 — continuous improvement)

Example: Implementing a Firewall

What is Attack Surface?

Definition

Attack Surface is the total sum of all possible entry points (attack vectors) where an attacker can try to access, extract, or damage a system.

Simple Analogy

Think of your house:

• Attack Surface = All doors + windows + vents + garage + pet door + skylight
• Security Controls = Locks, alarms, bars, security cameras

The more openings you have, the harder it is to secure them all.

Attack Surface vs Attack Vector

Types of Attack Surface

1. Digital Attack Surface (Code & Network)

All internet-facing systems, software, and network services.

2. Physical Attack Surface (Hardware & Access)

All physical access points to systems and data.

3. Social Engineering Attack Surface (Human)

Human vulnerabilities that can be exploited.

Attack Surface by Organization Size

Attack Surface Analysis

How to Analyze Attack Surface

Step 1: MAP all assets (inventory)
Step 2: IDENTIFY all entry points for each asset
Step 3: CLASSIFY entry points by risk (likelihood × impact)
Step 4: PRIORITIZE which to secure first
Step 5: MONITOR for new entry points

Attack Surface Checklist

How to Reduce Attack Surface

Attack Surface Reduction (ASR) Strategies

Microsoft's Attack Surface Reduction Rules (Example)

Microsoft Defender for Endpoint has built-in ASR rules:

The Inversion Principle

Every feature you add is a potential vulnerability. Every line of code is a potential bug. Every open port is a potential entry.

Good security = saying "no" to unnecessary features.

Relationship: Controls + Attack Surface

How They Work Together

ATTACK SURFACE (All potential entry points)
         │
         ▼
SECURITY CONTROLS (Protection at each entry point)
         │
         ├── Less Attack Surface = Fewer entry points to protect
         ├── Stronger Controls = Better protection per entry point
         └── GOAL: Minimize BOTH for maximum security

The Security Formula

Security Level = (Strength of Controls) ÷ (Size of Attack Surface)

Best case: Strong controls + Small attack surface = Very Secure
Worst case: Weak controls + Large attack surface = Very Vulnerable

Example Scenarios

Web Application Example (Detailed)

Real-World Scenarios

Scenario 1: E-commerce Website Incident

A small e-commerce website was hacked. Let's analyze why:

ATTACK SURFACE ANALYSIS:
├── Website with customer login (login page = entry point)
├── Search functionality (search bar = entry point)
├── Open port 22 for SSH (server = entry point)
├── Third-party payment API (API = entry point)
├── Admin panel at /admin (admin login = entry point)
└── Customer support email (email = social engineering)

WHAT WENT WRONG:
├── No rate limiting on login (weak control)
├── Open port 22 exposed to internet (unnecessary attack surface)
├── Old version of WordPress (known vulnerability)
└── No employee security training (social engineering risk)

ROOT CAUSE:
└── Large attack surface + weak controls = Breach inevitable

FIXES APPLIED:
├── Reduced attack surface → Disabled SSH external access
├── Strengthened controls → Added rate limiting, updated WordPress
├── Added WAF → Blocks common attack patterns
└── Employee training → Reduced phishing risk

Scenario 2: Office Network Security Assessment

Scenario 3: Home User

YOUR HOME ATTACK SURFACE:
├── WiFi router (port 80, 443 open by default)
├── Smart TV (connected to internet)
├── Smartphone (apps with various permissions)
├── Laptop (browsing, emails, online banking)
├── IoT devices (smart bulb, smart speaker)
└── Social media accounts (personal information)

YOUR CONTROLS:
├── Strong WiFi password + WPA3
├── Regular software updates on laptop
├── MFA on email and banking
├── Antivirus installed
└── Not reusing passwords

QUESTIONS TO ASK YOURSELF:
├── Are all unnecessary services disabled on your router?
├── Do you have a guest network for IoT devices?
├── Are you backing up your data?
├── Do you click links in unknown emails?
└── Do you use a password manager?