Types of cybersecurity controls and how to place them