Security Operations · Topic 1 of 14
Mitigation and Hardening Techniques
Security+ mitigating controls: segmentation, access controls, hardening, monitoring, mobile device management and application allow and block lists.
- 5 min
- Segmentation limits how far an attack can spread. Isolation cuts a system off almost entirely.
- Access controls apply least privilege with ACLs and permissions, and deny by default.
- Hardening removes unneeded software and services, closes ports, changes defaults and patches.
What it is
Mitigating controls are the practical steps that reduce the chance or the impact of an attack. Hardening is the part of mitigation that makes a system more resistant by removing weaknesses and unneeded features.
The exam presents a problem and asks you to choose the control that best fits. The skill is matching the risk to the control. This page covers segmentation, access controls, hardening, monitoring and alerting, mobile device management and application control.
How it works
Core mitigating controls
| Control | What it does | Example |
|---|---|---|
| Segmentation | Splits a network into zones so that a breach cannot spread freely | Separate virtual local area networks (VLANs) for servers and guests |
| Access controls | Limit who can reach a resource and what they can do | Access control lists (ACLs) and file permissions |
| Hardening | Removes weaknesses and unneeded features | Closing unused ports and changing default passwords |
| Monitoring and alerting | Detects problems early and tells the right people | Log review and alerts on failed logins |
| Mobile device management (MDM) | Enforces policy on phones and tablets | Remote wipe of a lost phone |
| Application control | Decides which programs may run | An allow list of approved software |
Segmentation
Segmentation limits lateral movement, which is the way an attacker hops from one system to another after the first break in. Zones are separated by firewalls or ACLs, and only the traffic each zone needs is allowed between them.
Isolation goes further and removes most or all connections, for example for a quarantined machine or an industrial controller that cannot be patched.
Access controls
Access controls apply least privilege: give each user, service and device only the rights it needs. On the network this means ACLs on routers, switches and firewalls. On systems it means file, share and application permissions.
Rules should deny by default and allow only what is required. Review them regularly, because unused permissions and old rules leave open paths.
Hardening
Hardening brings a system to an agreed secure configuration, often called a secure baseline. Industry benchmarks give recommended settings per product and are a common starting point.
| Hardening step | Purpose |
|---|---|
| Remove unneeded software and services | Fewer flaws to attack |
| Disable unused ports and protocols | Fewer entry points |
| Change default accounts and passwords | Defaults are public knowledge |
| Apply patches and firmware updates | Fix known flaws |
| Encrypt storage | Protect data if a device is lost |
| Install endpoint protection and a host firewall | Add local defense |
| Use secure management protocols | Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS), not Telnet or plain HTTP |
| Enable logging | Provide evidence and detection |
Hardening applies to every kind of system: workstations, servers, switches, routers, cloud resources, mobile devices and Internet of Things (IoT) devices. Settings drift over time, so systems are checked against the baseline and corrected.
Monitoring and alerting
Monitoring watches systems for signs of attack or failure, and alerting notifies staff when a rule or threshold is met. It is a mitigating control because early detection limits damage. Logs should be sent to a central store so that an attacker on one host cannot erase them.
Mobile device management
| MDM capability | Purpose |
|---|---|
| Remote wipe | Erase a lost or stolen device |
| Screen lock, personal identification number (PIN) and biometrics | Protect against casual access |
| Full device encryption | Protect stored data |
| Application management | Allow, block or push apps |
| Containerization | Separate work data from personal data |
| Patch and update enforcement | Keep the operating system current |
MDM can also detect rooted or jailbroken devices and block them from company resources.
Application control
| List type | How it works | Strength |
|---|---|---|
| Allow list | Only approved programs may run | Stops unknown malware by default |
| Block list | Known bad programs are stopped, everything else runs | Easy to manage, but misses new threats |
An allow list is stricter and needs more upkeep, since every new approved program must be added. A block list stops only what it already knows.
How the exam asks about this
- "Only approved software may run on the kiosk computers." -> An application allow list.
- "A breach of the guest Wi-Fi must not reach the payroll servers." -> Network segmentation.
- "A new web server should expose as little as possible." -> Hardening: remove unneeded services, close unused ports and patch.
What to remember for the exam
- Segmentation limits how far an attack can spread. Isolation cuts a system off almost entirely.
- Access controls apply least privilege with ACLs and permissions, and deny by default.
- Hardening removes unneeded software and services, closes ports, changes defaults and patches.
- Benchmarks give a starting point for a secure baseline, and drift must be corrected.
- Monitoring and alerting count as mitigations because they limit damage through early detection.
- MDM gives remote wipe, encryption, app management and containerization for mobile devices.
- An allow list permits only approved programs. A block list stops only known bad ones.
When a question says "only approved software may run", the answer is an application allow list, not antivirus.
Common mistakes
Choosing a block list when an allow list is asked for. A block list stops only what it knows. An allow list stops everything not approved.
Mixing segmentation with encryption. Segmentation controls where traffic can go. Encryption protects what the traffic contains.
Hardening once and never again. Settings drift, so systems must be checked against the baseline regularly.
Leaving default accounts in place. Default usernames and passwords are in public lists.
Assuming MDM encrypts network traffic. MDM enforces device policy. A virtual private network (VPN) or Transport Layer Security (TLS) protects traffic.
Do not disable a service until you know what depends on it. Use change management and a backout plan, even for hardening.
Check yourself
Which control permits only approved programs to run?
An application allow list.
What is the purpose of network segmentation?
It limits lateral movement by separating the network into zones, so a breach in one zone does not reach all systems.
Which MDM feature protects data on a stolen phone that cannot be recovered?
Remote wipe, backed by full device encryption.
Topic 1 of 14 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.