Control categories, CIA, AAA, and zero trust

Control categories, CIA, AAA, and zero trust

Security-control analysis separates two dimensions: the control category and the way the control functions. A category locates responsibility. A technical control is enforced by technology, such as an access-control list or encryption. A managerial control establishes direction, policy, and accountability. An operational control is performed by people through repeatable procedures, such as account review. A physical control protects a place or tangible asset through locks, barriers, lighting, or guards. Functional types answer a different question. Preventive controls stop an event, deterrent controls discourage it, detective controls reveal it, corrective controls restore a safe state, compensating controls reduce risk when the preferred control is unavailable, and directive controls require a behavior. One safeguard may have several labels: a security guard is physical and operational and may deter and detect. Therefore, memorizing names is not enough. Tie every control to an asset, threat, failure mode, owner, and measurable result. For server-room theft, a complete design might combine an administrative access policy, an operational visitor-review procedure, a technical badge reader, and a physical locked door. These safeguards are not duplicates; each addresses a different failure point. When a scenario asks for the best control, begin with the required function rather than a product name. Decide whether the need is prevention, detection, recovery, or a temporary substitute, then determine whether the selected category can operate in the real environment and who owns its operation and review.

The CIA triad describes three objectives for an asset. Confidentiality limits information to authorized parties and is supported by least privilege, encryption, and classification. Integrity preserves completeness and correctness and prevents unauthorized modification; hashes, digital signatures, change control, and separation of duties can support it. Availability means an authorized user can reach the resource when required; capacity, redundancy, tested backups, and denial-of-service protection support that goal. A safeguard does not always advance all three objectives equally. Full-disk encryption protects confidentiality when a laptop is stolen, but it does not restore a deleted file or keep a service online. AAA adds identity decisions. Authentication verifies a claimed identity, authorization decides what the authenticated identity may do, and accounting records who did what, when, and in which context. Successful MFA does not justify an administrator role, and an activity log does not prevent an action, although it creates evidence for investigation and accountability. Read the decisive fact in a scenario: exposure of a record is a confidentiality failure; an unauthorized change to an amount is an integrity failure; an unreachable portal is an availability failure; accepting a credential is authentication; denying a transaction after sign-in is authorization; and associating the transaction with a user identifier is accounting. A digital signature may support integrity, origin authentication, and non-repudiation, but only within assumptions about private-key protection, certificate trust, and correct verification.

Zero trust is neither a single product nor a statement that people can never be trusted. It is a decision model that grants no implicit access merely because a user is inside a corporate network or a device is enterprise-owned. For each request, the policy engine evaluates signals such as identity, authentication strength, device posture, resource sensitivity, location, time, and session behavior. A policy administrator communicates the decision, while a policy enforcement point allows, denies, or challenges the request. The control plane that calculates policy is logically distinct from the data plane carrying user traffic. In practice, the model calls for least-privilege access, segmentation, continuous evaluation, and an assumption that compromise is possible. Continuous evaluation does not require a password prompt every second; it can trigger when risk changes, for example when a managed endpoint becomes noncompliant or a session begins an unusual download. Failure behavior must be designed deliberately. Automatically allowing access when the policy engine is unavailable may preserve availability but destroy confidentiality; automatically denying access protects the resource but can stop a critical process. The correct choice depends on resource sensitivity, continuity requirements, and a monitored emergency path. Useful measures go beyond the number of policies created. Measure correctly denied requests, time to revoke a session after posture changes, the proportion of resources still accepting broad access, and false-positive rates. Those measures connect zero-trust architecture to CIA and AAA rather than treating it as a slogan.

Use a four-question control-selection matrix. What asset and security outcome matter? Is the function preventive, detective, corrective, or compensating? Which category actually implements it: technical, managerial, operational, or physical? What evidence proves operation? In payroll, preventing an employee from reading a colleague's record protects confidentiality. Role authorization is a technical preventive control, role review is an operational detective control, and separation policy is managerial and directive. Successful sign-in does not prove correct authorization. Tests include a user reading the correct record, a user requesting an unauthorized record, and a manager reading only an assigned group. The expected result is two allowed actions and one policy-explained denial, not merely a login screen. Policy-engine failure behavior is decided in advance: fail closed or use a limited monitored emergency path, balancing confidentiality and availability.

When payroll confidentiality conflicts with emergency availability, define who authorizes an emergency path, its expiry, and review of every request. Test one allowed case and one out-of-role case. Both continuity and bounded access must hold; otherwise the zero-trust label is merely decorative.