This is spurred on by a comment a pen tester made. He was referring to a particular technology and said something to the effect of, "What do you expect? It's 30 year-old technology." I was stunned when the comment was relayed to me. My response was, "An armed guard with an M16 can be an effective control. And the M16 has been around since the 1960s. And that's 40 year-old technology." The point is that the age of a technology or control is not all the most relevant factor. What is relevant is whether or not the control is effective. A similar corollary is it doesn't matter how expensive the control is, it still boils down to whether or not the control is effective.

A good example I can think of is at a military base I once visited. The base had gates with armed security personnel. However, unless there was a reason to suspect a threat (and where this base was located, it wasn't very likely), the weapons were holstered and unloaded. The base had no means of preventing a car from turning onto the road that ran through the middle of the base and driving right by the main gate. So if someone wanted to get onto the base, that gate was not an effective control. Even if the security forces were armed, if someone turned onto the road to the gate, they could build up a good rate of speed before reaching the gate. You can draw the obvious conclusions as to how effective the gate was in that situation. Now, at the time I visited, the world was a kinder, gentler place. Also, as I pointed out, there wasn't likely a threat to the base. The gate was there to ensure the merely curious stayed out and to catch military personnel who might have gone out on the town, imbibed a bit too much, and decided to drive back to the barracks or base housing. Those were bigger risks.

Then there is this:

These "dragon's teeth" were part of the Siegfried Line and were reinforced concrete pyramids that were designed to make driving a tank through a very risky proposition. Low-tech, reasonably inexpensive, and based on older technology, but they were an effective control at that time.

And that's what it really boils down with respect to a control. Does it protect against the threat it was put in place to guard against? If the answer is yes, then it doesn't matter how old it is or how cheap it is. Similarly, if the answer is no, then it doesn't matter how new it is or how much money was spent on it.