Chapter 2.5 - Mitigation Techniques

What is the purpose of segmentation?

• to increase platform security

• physically, logically, virtually

• acls to control user access

What is an ACL?

• access control list

• controls user access

What is patching?

• updating

• third-party updates

• auto-updates

What is encryption?

• prevents access to application data files

• full disk encryption (FDE)

• application data encryption

What is monitoring?

• gathering data from devices

  • built-in sensors

  • separate devices

• sensors

  • IPS

  • logs

• collectors

  • SIEM, syslog

What is least privilege?

• rights and permissions should be set to the bare minimum

What is configuration enforcement?

• perform a posture assessment

• extensive check

  • patch version

  • certificate status

• systems out of compliance are quarantined

What is decommissioning?

• should be a formal policy

• storage devices need to prioritized

What are some different types of hardening techniques?

• updates/patches

• protecting user accounts

• anti-virus/malware

• encryption

• securing network endpoints

• host-based firewall