Threats, Vulnerabilities, and Mitigations · Topic 9 of 9
Mitigation and Hardening Techniques
Security+ mitigation and hardening: segmentation, isolation, allow lists, patching, least privilege, configuration enforcement and decommissioning.
- 4 min
- Segmentation limits how far an attack can spread. Isolation cuts off a system almost entirely.
- An application allow list permits only approved software, which stops unknown malware by default.
- Patching fixes known flaws, and compensating controls cover systems that cannot be patched.
What it is
Mitigation techniques are the practical steps that reduce the chance or the impact of an attack. Hardening is the part of mitigation that makes a system more resistant by removing weaknesses and unneeded features.
The exam presents a problem and asks you to choose the technique that best fits. The skill is matching the risk to the control.
How it works
Core mitigation techniques
| Technique | What it does | Example |
|---|---|---|
| Segmentation | Splits a network into zones so that a breach cannot spread freely | Separate virtual local area networks (VLANs) for servers and guests |
| Access control | Limits who can reach a resource | Access control lists (ACLs) and permissions |
| Application allow list | Only approved programs may run | Blocks unknown or malicious software |
| Isolation | Separates a system from the rest of the network | Quarantining an infected host |
| Patching | Fixes known flaws | Applying vendor security updates |
| Encryption | Protects data from being read | Disk and network encryption |
| Monitoring | Detects problems early | Log review, alerts, intrusion detection |
| Least privilege | Gives only the rights needed | Standard user instead of administrator |
| Configuration enforcement | Keeps systems in an approved state | Policy that resets changed settings |
| Decommissioning | Safely retires old systems | Wiping disks and removing accounts |
An application allow list is stricter than a block list. It permits only what is known to be safe, so new malware is stopped by default.
Patching in practice
Patching reduces exposure to known vulnerabilities. It should be tested first when possible, scheduled through change management and verified afterward. Systems that cannot be patched need compensating controls such as isolation.
Segmentation and isolation
Segmentation limits lateral movement, which is the way an attacker hops from one system to another after the first break in. Isolation goes further and removes most or all connections, for example for a quarantined machine or an industrial controller.
Hardening techniques
| Hardening step | Purpose |
|---|---|
| Encryption | Protect stored and transmitted data |
| Install endpoint protection | Block malware and detect suspicious behavior |
| Host based firewall | Control traffic to and from one device |
| Host based intrusion prevention system (HIPS) | Detect and block attacks on the host |
| Disable ports and protocols | Remove unused entry points |
| Change default passwords | Remove well known credentials |
| Remove unnecessary software | Reduce flaws and attack surface |
Hardening starts from a secure baseline, which is an agreed standard configuration. Changes from the baseline are then detected and corrected.
Decommissioning
When a system is retired, remove it from inventory and monitoring, delete its accounts and credentials, and sanitize or destroy its storage. Forgotten systems stay on the network without patches, which makes them easy targets.
What to remember for the exam
- Segmentation limits how far an attack can spread. Isolation cuts off a system almost entirely.
- An application allow list permits only approved software, which stops unknown malware by default.
- Patching fixes known flaws, and compensating controls cover systems that cannot be patched.
- Least privilege limits the damage from compromised accounts.
- Configuration enforcement keeps systems at the secure baseline.
- Hardening includes closing ports, removing software, changing default passwords and adding endpoint protection.
- Host based firewalls and HIPS protect individual machines.
- Decommissioning must include data sanitization and account removal.
When a question says "only approved software may run", the answer is an application allow list, not antivirus.
Common mistakes
Choosing a block list when an allow list is asked for. A block list stops only what it knows. An allow list stops everything not approved.
Treating patching as optional for internal systems. Attackers who get a foothold use internal flaws for lateral movement.
Forgetting to remove old accounts. Orphaned accounts and credentials remain usable after a system is retired.
Mixing segmentation with encryption. Segmentation controls where traffic can go. Encryption protects what the traffic contains.
Hardening once and never again. Settings drift, so enforcement and periodic checks are needed.
Patching without testing can break critical systems. Test first and have a backout plan, but do not delay urgent security fixes without a reason.
Check yourself
Which technique permits only approved programs to run?
An application allow list.
What is the purpose of network segmentation?
It limits lateral movement by separating the network into zones, so a breach in one zone does not reach all systems.
Name two hardening steps.
Disabling unused ports or services, and changing default passwords. Removing unneeded software also counts.
Topic 9 of 9 in Threats, Vulnerabilities, and Mitigations
Test yourself on Threats, Vulnerabilities, and Mitigations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.