Mitigation techniques

Mitigations shrink what an attacker can reach and limit what they can do once in. The exam lists segmentation, access control, application allow lists, isolation, patching, encryption, monitoring, least privilege, configuration enforcement, decommissioning, and hardening techniques.

Reduce reach

Segmentation divides a network into zones so a compromise in one doesn't spread; VLANs, subnets, and firewalls between them enforce it. Isolation goes further, cutting a system off entirely (for example, quarantining an infected host). Access control lists and permissions decide who can reach which resources, and least privilege keeps each account at the minimum it needs.

Hardening

Hardening removes what isn't needed and locks down what is. Typical steps: install endpoint protection and a host-based firewall, use a host-based intrusion prevention system (HIPS), disable unused ports and protocols, change default passwords, remove unnecessary software, and apply a secure configuration baseline. Configuration enforcement tools make sure systems don't drift away from that baseline over time.

Decommissioning retires systems properly: remove them from inventory and DNS, revoke their certificates and accounts, and sanitize their storage. Forgotten servers that keep running unpatched are a common way in.

Key terms

Segmentation

Dividing a network into separate zones so a compromise in one can't easily spread to others.

Isolation

Completely separating a system from other networks or hosts to contain a threat.

Application allow list

A control that permits only pre-approved software to run and blocks everything else.

Least privilege

Giving each user or process only the access it needs to do its job, and no more.

Patching

Applying vendor updates that fix known vulnerabilities and bugs.

Configuration enforcement

Tools and processes that keep systems on their approved secure baseline and correct drift.

Decommissioning

Retiring a system securely by removing access, records, and data before disposal.

Host-based firewall

Software on an individual device that filters network traffic to and from it.

Host-based intrusion prevention system (HIPS)

Software on a host that detects and blocks suspicious behavior or attacks on that device.

Disabling unused ports and protocols

Turning off services, ports, and protocols that a system doesn't need to reduce attack surface.

Removing unnecessary software

Uninstalling programs that aren't needed so they can't be exploited or need patching.

Encryption as mitigation

Making data unreadable to anyone without the key so theft doesn't expose it.

Monitoring

Continuously collecting and reviewing activity data to spot attacks early.