What is a detective control?
A detective control finds and records a security event while it is happening or after it has happened. It doesn't stop the event. Its job is to make sure someone knows, so the event can be investigated and a response can begin. Detection covers the gap that preventive controls always leave: attacks they miss, insiders with legitimate access and mistakes nobody intended.
Examples of detective controls
- Technical: audit logs, SIEM correlation rules and alerts, intrusion detection systems, file integrity monitoring, honeypots and honeytokens, DLP in monitor mode.
- Physical: recorded CCTV, motion sensors, door-held-open alarms, smoke detectors.
- Managerial: mandatory vacation and job rotation, which tend to surface hidden fraud, and periodic access reviews.
- Operational: an analyst reviewing firewall logs each morning, a guard on patrol, a visitor sign-in log.
Example: detection in a log
A SIEM collects these Windows Security events during a password-guessing attempt:
02:14:07 4625 An account failed to log on. Account Name: j.alvarez Source Network Address: 203.0.113.45
02:14:31 4740 A user account was locked out. Account Name: j.alvarez
The lockout policy stopped the guessing, which is preventive. The event records and the SIEM alert built on them are detective: they tell an analyst that someone at 203.0.113.45 was guessing passwords at 2 a.m. Without them, the attacker could move on to the next account unnoticed.
Detection only helps if someone acts on it
An IDS that alerts into a mailbox nobody reads detects nothing in practice. Detective controls need tuning to keep false positives low, synchronized clocks so events can be put in order, logs forwarded to a central system where an intruder can't erase them, and a response process that starts when an alert fires. Windows event 1102, which records that the audit log was cleared, deserves an alert of its own, because attackers try to remove the evidence detective controls create.
Detective vs. preventive vs. corrective
Detective controls report, preventive controls block and corrective controls fix. One product can play all three roles, so classify what it did in the scenario:
- An IDS that raises an alert is detective; an IPS inline that drops the traffic is preventive.
- A DLP policy in monitor mode logs an email containing card numbers and still delivers it, so it is detective. In block mode it stops the email and becomes preventive.
- EDR flagging suspicious file renaming is detective; EDR killing the process and isolating the host is corrective.
- A camera that records a theft is detective. It does not stop the theft, which makes preventive a common wrong answer for cameras, although a visible camera can also deter.
Detective control on the CompTIA Security+ exam
Control types belong to SY0-801 objective 1.1. Words such as identify, discover, alert, log, record, monitor, review and audit point to detective. Watch for scenarios that pair detection with a constraint: a weekly log review that stands in for a SIEM the organization can't afford yet is compensating, not just detective. Keep type and category separate: a motion sensor is physical and detective, and mandatory vacation is managerial and detective. When a question asks which control would identify who did something, a detective control is right; when it asks which would have stopped it, look for a preventive one.