Packet Flipper
Mitigation techniques

Mitigation techniques

This objective focuses on mitigation techniques, the proactive defenses, strategies, and architectural controls implemented to reduce the attack surface, limit the blast radius of a breach, and secure corporate assets.

Let’s break these core technical mitigation and hardening concepts down step by step.

1. Architectural & Logic Mitigations

These techniques focus on designing networks and access logic so that if an attacker breaches one boundary, they cannot easily move throughout the rest of the enterprise.

Segmentation & Isolation

  • Segmentation: Splitting a unified physical network into smaller, logical sub-networks (VLANs).
    • Example: Placing corporate workstations on VLAN 10, guest Wi-Fi on VLAN 20, and sensitive accounting servers on VLAN 30. A firewall strictly controls the traffic flowing between these zones.
  • Isolation: Taking a highly critical or vulnerable system and completely removing its ability to communicate with the rest of the network.
    • Example: If an enterprise relies on an unpatchable legacy system, placing it in an isolated segment with zero internet access and restricting connections to just one dedicated admin workstation.

Access Control & Least Privilege

  • Least Privilege: The core security principle that users and accounts should only be granted the absolute minimum privileges necessary to perform their specific job functions, and nothing more.
  • Access Control Lists (ACLs): Rules applied to network routers or firewalls that filter incoming and outgoing traffic based on criteria like source IP, destination IP, or port number.
  • Permissions: Object-level access rules.
    • Example: Using Linux file permissions (chmod) or Windows NTFS permissions to grant the HR group “Read/Write” access to a payroll folder, while blocking the rest of the company from seeing it.
  • Application Allow List: A highly effective control in which an administrator defines an explicit list of approved software executables permitted to run on corporate endpoints. If malware attempts to execute, the operating system blocks it because it isn’t on the pre-approved list.

2. Operational & Lifecycle Mitigations

Maintaining security is a continuous lifecycle. These methods ensure systems stay secure over time and are retired safely.

  • Patching: The regular process of updating operating systems and applications to fix known security vulnerabilities. Automated patch management ensures that critical flaws are remediated before threat actors can exploit them.
  • Monitoring: Implementing continuous visibility across the enterprise (using tools like SIEM, EDR, and centralized logging). Monitoring ensures that, if an attacker bypasses preventive controls, defenders detect suspicious behavior in real time.
  • Configuration Enforcement: Using automation tools (such as Group Policy, Ansible, or cloud policy engines) to ensure systems maintain a baseline security posture. If a user tries to disable a local security setting, the enforcement tool automatically reverts it back to the secure corporate standard.
  • Decommissioning: The secure, structured process of retiring old hardware, software, or accounts.
    • Example: When retiring an old server, decommissioning ensures that its DNS records are removed, its Active Directory computer object is deleted, and its hard drives are physically shredded or wiped using an approved cryptographic erase standard, so no residual corporate data leaks.

3. Hardening Techniques

Hardening is the process of securing a single host, server, or device by reducing its local attack surface and eliminating default vulnerabilities.

Core Endpoint Protections

  • Encryption: Enabling data-at-rest encryption (such as BitLocker or LUKS full-disk encryption) so that local data is unreadable if the physical asset is lost or stolen.
  • Installation of Endpoint Protection: Deploying Next-Generation Antivirus (NGAV) or Endpoint Detection and Response (EDR) software to continuously monitor local system processes for malicious activity.
  • Host-Based Firewall: Running local software firewalls on individual operating systems (like Windows Defender Firewall or iptables/nftables in Linux) to block unauthorized inbound network connections directly at the endpoint level.
  • Host-Based Intrusion Prevention System (HIPS): A local security application that monitors system behavior (such as registry modifications, system file changes, and memory space execution). Unlike a standard firewall that only inspects network traffic, a HIPS can actively block a local process if it behaves maliciously.

Cleaning Up the Attack Surface

  • Disabling Ports and Protocols: Turning off unnecessary or insecure network services.
    • Example: Disabling unencrypted protocols like Telnet (Port 23) or anonymous FTP (Port 21) on a production server and enforcing the use of SSH (Port 22) or SFTP instead.
  • Default Password Changes: Modifying factory settings immediately upon device deployment. Leaving default administrative logins active on network infrastructure is one of the most common vectors for automated scanning exploits.
  • Removal of Unnecessary Software: Uninstalling pre-installed bloatware, unused application packages, and legacy utilities from a system baseline image. If a software package isn’t installed on the system, an attacker cannot exploit any future vulnerabilities in it.