Mitigation Techniques
Explain the purpose of mitigation techniques used to secure the enterprise
What you will learn
- Name the core mitigation techniques and know what each one addresses.
- Separate segmentation from isolation, and hardening from configuration enforcement.
- Recognise when patching is impossible, and what replaces it.
- Pick the mitigation that fits a described situation instead of stacking every control.
This objective's questions are practical: the question describes a situation and asks for the best mitigation. The skill is choosing what fits rather than what is strongest — encrypting a database does nothing about excessive permissions, and network segmentation does not fix a default password. Read what specifically failed.
The techniques
| Segmentation | Splitting the network into zones that reach each other only through controls. It limits lateral movement after a compromise. |
|---|---|
| Isolation | Cutting a system or process off completely. Stronger than segmentation: not controlled communication, but none. |
| Access control | Who reaches what: access control lists, permissions, and least privilege. |
| Least privilege | The minimum permission that does the job. It limits what a compromised account can do. |
| Hardening | Shrinking a host's attack surface: closing ports, removing unneeded services, disabling default accounts. |
| Configuration enforcement | Automatically imposing the approved configuration and pulling back any host that drifts. Hardening sets the state; this keeps it. |
| Patching | Closing a known flaw. The highest return for the least effort — when it is possible. |
| Decommissioning | Taking out of service what is no longer needed. The surest mitigation: what does not exist cannot be attacked. |
| Monitoring | Prevents nothing, and shortens time to detection — which is usually what decides how large the damage gets. |
Segmentation vs isolation
| Segmentation | Isolation | |
|---|---|---|
| Connectivity | Controlled and conditionally allowed | Cut |
| Purpose | Limiting spread and narrowing compliance scope | Containing something dangerous or unfixable |
| Example | A guest network separated from the staff network | An infected host pulled off the network during response |
Hardening in practice
Remove what is unused
Services, software, accounts. Anything kept without a reason is attack surface with nothing in return.
Close unnecessary ports
Change default credentials
The cheapest step and the most neglected — and vendor manuals publish those defaults to everyone.
Turn on encryption and logging
Then enforce the configuration and watch for drift
Hardening is a one-off; enforcement is continuous. Without it the host drifts back within months.
Patching is not always available
Three cases have no patch: a zero-day the vendor does not know about, a system past end of support, and a legacy system that breaks when updated. In those, the answer is compensating mitigation: isolation, restricted access, heavier monitoring. Any option saying "apply the latest update" is wrong, however much it reads like best practice.
Real-world example: which mitigation addresses what
An accounting employee's account is compromised by phishing; from it the attacker reaches the development servers and then the customer database. Four failures, each with its own mitigation: the initial access is addressed by awareness training and multi-factor authentication; the hop from accounting to development by network segmentation; an accounting account being able to read the customer database by least privilege; and two weeks of going unnoticed by monitoring. Note that none alone is sufficient — and that if the question narrows to "how do we stop movement between departments", the answer is segmentation alone.
Ask: what exactly failed?
Got in the door = authentication and awareness. Moved between systems = segmentation. Reached what was not theirs = least privilege. Went unnoticed = monitoring. Exploited a known flaw = patching. Used a service that need not exist = hardening. The mitigation matches the failure, not the size of the threat.
What matters on the exam
- The question asks for what fits, not what is strongest. Encrypting everything is not an answer to a question about permissions.
- "Limit lateral movement" = segmentation. "Stop a compromised account reaching what is not theirs" = least privilege.
- Decommissioning is a legitimate and frequently overlooked answer: what does not exist cannot be attacked.
- Monitoring prevents nothing. If the question asks about prevention it is not the answer; if it asks about shortening detection time, it is.
Quick check
Answer in your head first, then reveal.
What is the practical difference between segmentation and isolation?Reveal the answer
Segmentation allows controlled communication between zones through controls; isolation cuts it. Segmentation is a standing design; isolation is usually a containment action, or the answer for a system that cannot be fixed.
An industrial controller cannot be updated and must keep running. What is the mitigation?Reveal the answer
Isolate it, or place it on a tightly controlled segment, restricting what reaches it and what leaves it, with heavy monitoring — a compensating control in objective 1.1's language. Patching is not on the table at all.
What separates hardening from configuration enforcement?Reveal the answer
Hardening puts the host into the secure state once; enforcement keeps it there and reverts any drift. Without the second, the host slides back over time with every manual change.
Why is decommissioning a mitigation rather than mere tidying up?Reveal the answer
Because it removes the attack surface entirely instead of shrinking it. A system that no longer runs needs no patching, no monitoring and no compensating control — the only answer that leaves no residual risk.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.