Cybersecurity Mitigation Techniques Quiz

Mitigation Techniques

• Mitigations are actions to reduce threat and vulnerability severity.
• They use procedural, technical, or management controls.
• Goal is to lower risk to an acceptable level.
• Mitigations are vital because threats and vulnerabilities constantly evolve.
• Without them, organizations risk data breaches, service disruptions, and reputational damage.

Segmentation

• Dividing a network into smaller parts isolates different traffic types.
• Makes it harder for attackers to move laterally within the network.
• Examples include separating accounting and R&D into different subnets.
• Use VLANs, subnets, and firewalls for efficient segmentation.

Access Control

• Authorised users gain access to specific resources only.
• Roles and permissions are key for access control.
• Not everyone should have admin access to a database, for example.
• Learn RBAC (Role-Based Access Control) and its configuration.

Application Allow List

• Permits specific applications to run on a system.
• Prevents unauthorized applications (like malware) from execution.
• Experiment with allow listing on a test machine to understand it.

Isolation

• Separates systems or processes from each other to minimize unauthorized access risk.
• Can include deploying a DMZ to isolate publicly accessible servers from the internal network.

Patching

• Applying updates to software to fix security vulnerabilities.
• Timely patching can prevent attacks (e.g., WannaCry).
• Use a patch management system for regular updates.

Encryption

• Protects data confidentiality by converting it to unreadable format.
• Encrypt sensitive data in transit and at rest.
• Understand symmetric and asymmetric encryption.

Monitoring

• Continuously monitors systems for anomalies and threats.
• Use SIEM tools (e.g., Splunk, ELK Stack) for practical experience.

Least Privilege

• Granting users and systems only necessary permissions to perform their tasks.
• Avoid unnecessary privileges.

Configuration Enforcement

• Automated tools enforce consistent configurations across multiple systems.
• Ensures uniformity and compliance with security policies.
• Use configuration management tools (e.g., Ansible, Puppet).

Decommissioning

• Securely remove hardware and software to eliminate lingering security risks.
• Involves securely erasing data and revoking access.
• Understand secure data deletion guidelines (e.g., NIST).

Hardening Techniques

• Configuring systems to remove unnecessary functions and secure remaining ones.
• Disable unnecessary ports and services.

Summary

• Mitigation techniques are multifaceted strategies reducing risks from threats and vulnerabilities.
• Mastering these techniques is vital for robust cybersecurity posture.

Review Questions

• What is the least privilege principle, and why is it important?
• How does network segmentation improve security?
• What's the role of monitoring in mitigations?

Key Points

• Mitigations are crucial for risk reduction.
• Techniques vary (segmentation, hardening), each with unique benefits.

Practical Exercises

• Implement a basic network segmentation scheme in a lab.
• Configure Role-Based Access Control on a test server.