CoreQ Academy2.5 Explain the purpose of mitigation techniques used to secure the enterprise.
Mitigations reduce likelihood or impact. Most breaches would have been prevented by basic mitigations done consistently: patching, least privilege, segmentation and hardening.
Mitigation techniques
- Segmentation
- Dividing the network into zones so a compromise in one area cannot easily spread.
- Access control list (ACL)
- A list of rules that permits or denies traffic or access to a resource.
- Permissions
- Rights assigned to users or groups on files and systems; should follow least privilege.
- Application allow list
- Only approved applications can run; everything else is blocked. Stronger than deny lists.
- Isolation
- Separating a system completely (quarantine, sandbox, air gap) to contain a threat or protect a sensitive asset.
- Patching
- Applying vendor fixes. Prioritise by exposure and severity.
- Encryption
- Protecting data at rest and in transit so stolen data is unreadable.
- Monitoring
- Watching logs, systems and networks to detect issues quickly.
- Least privilege
- Give each identity only the access needed for its task, for only as long as needed.
- Configuration enforcement
- Automatically applying and checking secure settings against a baseline (Group Policy, MDM, configuration management).
- Decommissioning
- Retiring systems properly: removing access, wiping data and removing them from inventory and DNS so they are not left forgotten and exposed.
Hardening techniques
- Encryption (hardening)
- Enabling disk and protocol encryption on each system.
- Installation of endpoint protection
- Antivirus/EDR agents to detect and block malware.
- Host-based firewall
- A firewall on each host limiting inbound and outbound connections.
- Host-based intrusion prevention system (HIPS)
- Software on the host that detects and blocks malicious behaviour.
- Disabling ports/protocols
- Turning off unneeded services and insecure protocols (Telnet, FTP, SMBv1).
- Default password changes
- Replacing factory credentials on every device and app.
- Removal of unnecessary software
- Fewer programs means fewer vulnerabilities to patch.
Hands-on practice
Check your understanding
Knowledge quiz · pass mark 80%
- Decommissioning only requires powering off the server.
- Which control allows only approved programs to execute?
- Limiting lateral movement after a compromise is the main purpose of:
- Which are hardening techniques? (choose all)
Original CoreQ Academy material, mapped to objective 2.5 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.