What is the difference between preventive and detective security controls?

Question

Accepted Answer

**Preventive** — stop attacks. **Detective** — identify attacks.

**Preventive Controls:**
- Stop attacks before they happen.
- Firewalls, encryption.
- Access controls.
- Proactive.

```
Preventive:
Firewall: block unauthorized access
Encryption: prevent data theft
Authentication: prevent unauthorized access
(Stop attacks)
```

**Detective Controls:**
- Identify attacks in progress.
- IDS, SIEM.
- Log monitoring.
- Reactive.

```
Detective:
IDS: detect intrusion attempts
SIEM: analyze security events
Logs: track suspicious activity
(Identify attacks)
```

**Key differences:**
- **Preventive** — stop attacks.
- **Detective** — identify attacks.
- **Preventive** — proactive.
- **Detective** — reactive.

Systems Analyst: What is the difference between preventive and detective security controls?