While it is possible to make an argument that the network firewall fits into all of these categories, a firewall’s primary purpose is to block unwanted traffic from entering the network. Therefore, it is best described as a preventative control. Detective controls are designed to identify malicious activity that occurs. Corrective controls are designed to restore normal service after a security incident. Deterrent controls are designed to discourage a potential attacker from attempting an attack.