What is a deterrent control?
A deterrent control makes an attack look riskier or less rewarding, so the attacker decides not to try. It doesn't block anything physically or logically. Its effect depends entirely on the person who sees it: an opportunist may walk away, while a determined attacker ignores it. CompTIA's SY0-801 objectives call this control type deterring; deterrent is the more common word, and the meaning is the same.
Examples of deterrent controls
- Physical: warning signs such as "Trespassers will be prosecuted", bright exterior lighting, visible cameras, a guard at the front desk, and low perimeter fencing that discourages casual trespassers.
- Technical: login banners that warn of monitoring and prosecution.
- Managerial: a published sanctions policy that spells out discipline for misuse.
Many of these have more than one type. A guard deters by being seen, prevents by refusing entry and detects on patrol. Lighting deters and also helps cameras and guards see.
Example: a login banner
On a Linux server, a single line in the SSH daemon's configuration file, /etc/ssh/sshd_config, displays a warning before authentication:
Banner /etc/issue.net
The banner file might read: WARNING: Authorized use only. All activity is monitored and logged. Unauthorized access will be reported to law enforcement. On Windows, the Group Policy settings for the interactive logon message title and text do the same at the sign-in screen. Legal teams often want banners for a second reason: they show that users were told about monitoring, which supports later discipline or prosecution.
The limits of deterrence
A deterrent only works on someone who notices it and cares about the consequence. Automated attack tools never read a banner, and a crew that has planned a break-in won't turn back because of a sign. That is why deterrent controls are paired with preventive controls, which work regardless of intent, and detective controls, which record what happens anyway. A lock still stops the person who ignored the sign.
Deterrent vs. directive vs. preventive
A deterrent warns what will happen if someone misbehaves. A directive control states what people must or must not do. "Authorized personnel only" is directive; "Trespassers will be prosecuted" is deterrent. Banners split the same way: one that warns of consequences deters, while a notice that lists usage rules directs. A preventive control makes the attempt fail. To separate deterrent from preventive, ask what happens when someone ignores the control. If they get through, it was a deterrent.
Deterrent control on the CompTIA Security+ exam
Control types are part of SY0-801 objective 1.1, which writes this type as deterring. Words such as discourage, dissuade and warn point to deterrent, and so do signs, lighting, visible cameras and banners described as warnings. Distractors are usually preventive controls (locks, bollards, firewalls) and directive controls (policies and instructional signs). Cameras are the classic trap: a visible camera deters, a camera that records is detective, and neither one is preventive. Read the scenario's verb to decide which function the question means, and keep type separate from category, since a deterrent can be physical, technical or managerial.