Administrative and Technical Network Security
Policy hierarchy and control types
Administrative security is the paperwork and process layer: policies (management intent), standards (mandatory specifics such as AES-256), procedures (step-by-step), and guidelines (recommended). Supporting programs include security awareness training, acceptable use, BYOD, data classification, onboarding/offboarding, background checks, separation of duties, job rotation, and mandatory vacation. Technical security enforces those requirements with systems: AAA, password and lockout policy, GPO and baseline configuration, patch management, logging, NAC, and encryption. Physical security is the third leg.
Controls are also classified by function. Preventive stops an event (firewall rule, lock, badge). Detective discovers it (IDS, log review, camera). Corrective fixes it (restore from backup, patch). Deterrent, compensating, and recovery controls round out the set, and a single control can belong to several classes.
Traps
Examiners love control-type classification. Security awareness training is an administrative preventive control, not a technical one; a security camera is physical detective; a backup restore is corrective. Also watch the standard-versus-guideline distinction (mandatory vs recommended) and the difference between least privilege (minimum rights to do the job) and need to know (minimum data).
Rule of thumb
Classify twice: by nature (administrative, technical, physical) and by function (preventive, detective, corrective). If a stem gives you a scenario and asks what to implement FIRST, the answer is almost always a policy, baseline, or training - the administrative foundation precedes the tool.