2.5 Explain the purpose of mitigation techniques used to secure the enterprise

★ Starred in your notes: port security · DHCP snooping · loop protection (STP).

Breakdown 1 — The mitigation toolbox

Technique	What it does	When the exam wants it
Segmentation	Split the network into zones (VLANs, subnets, firewalled segments) so a compromise can't spread	Legacy/unpatchable systems, IoT, OT, PCI scope reduction
Access control — ACL	Rules that permit/deny by IP/port/protocol/user	"Only the admin subnet may reach the management interface"
Access control — permissions	File/share/object permissions (NTFS, share, RBAC)	Least privilege; NTFS: the most restrictive permission wins (class)
Application allow list	Only approved executables run (vs. block list/deny list, which only stops known-bad)	Kiosks, servers, ransomware prevention
Isolation	Air-gap or sandbox a system/process	Malware analysis, high-value systems, sheep-dip computer (class: an isolated machine with all scanners installed, used to check removable media)
Patching	Fix known vulnerabilities on a schedule; test first (change management)	Most vulnerability-remediation questions
Encryption	Protect data at rest/in transit/in use	Stolen laptop, sniffed traffic
Monitoring	Logs, SIEM, IDS, FIM to detect what preventive controls miss	Detective layer
Least privilege	Only the access needed for the job, for as long as needed	Insider threat, privilege escalation
Configuration enforcement	Baselines applied and re-applied automatically (GPO, MDM, IaC)	Drift, "settings keep changing back"
Decommissioning	Retire systems properly: remove from network, sanitize/destroy media, revoke credentials/certs, update inventory	End-of-life systems

From class — ACL rules: Implicit deny → default is "no"; anything not explicitly allowed is blocked (the secure default). Implicit allow → everything is allowed by default (insecure). Firewalls block ports; egress = outbound, ingress = inbound.

Breakdown 2 — Hardening techniques (Chapter 11 in class: patching – secure configuration – application control)

Hardening step	Purpose
Encryption (FDE/SED)	Data safe if device lost
Installation of endpoint protection	AV/EDR/HIPS on every host
Host-based firewall	Per-host ingress/egress control
HIPS	Host intrusion prevention — blocks malicious behavior locally
Disabling ports/protocols	Every open port is attack surface; turn off Telnet, SMBv1, unused services
Default password changes	Kill default credentials on day one
Removal of unnecessary software	Less code = fewer vulnerabilities (bloatware, sample apps)

From class — trusted operating systems & application control: allow lists (whitelisting) vs. block lists (blacklisting); code signing → the vendor signs the binary so you can verify publisher and integrity (not a guarantee of "no malware" — it proves who published it and that it wasn't altered). Password minimum age ("waiting to change password so they don't change it back and forth") stops users cycling straight back to an old password.

Breakdown 3 — Network-side mitigations from class (Chapter 5–6)

Switch/network feature	Attack it stops
Port security — only specific MAC addresses on a port	Rogue devices, MAC flooding
MAC filtering	Unknown devices (weak — MACs can be spoofed)
DHCP snooping	Rogue DHCP servers, DHCP starvation
Dynamic ARP inspection (DAI)	ARP poisoning / on-path
Loop protection (STP, BPDU guard)	Switching loops / broadcast storms
Flood guard	MAC/SYN flood DoS
MACsec (802.1AE)	Layer-2 eavesdropping
Micro-segmentation — each device has its own firewall (class)	Lateral movement (core Zero Trust idea)
NAC — checklist before the user gets connected (class)	Non-compliant/unknown endpoints
DNS sinkhole / DNS filtering	Malware C2 and phishing domains

Breakdown 4 — Matching mitigation to problem (exam pattern)

Scenario	Best mitigation
Unpatchable SCADA controller	Segmentation / isolation (compensating control)
Ransomware ran from a user's Downloads folder	Application allow list
Users keep installing random software	Allow list + least privilege (no local admin)
Settings drift after admins "fix" things by hand	Configuration enforcement (GPO/baseline)
Attacker moved laterally after one workstation fell	Segmentation / micro-segmentation, least privilege
Old server being retired	Decommissioning: sanitize, revoke, inventory
Default creds on new IoT devices	Change default passwords; NAC

Exam tip: "Reduce attack surface" almost always = disable unnecessary ports/protocols/services and remove software. "Limit blast radius" = segmentation/least privilege. "Known-good only" = allow list.

Quick self-check

• Allow list vs. block list — which is stronger and why? (Allow list: stops unknown malware too.)
• What's implicit deny? (Default block for anything not explicitly permitted.)
• What does DAI protect against? (ARP poisoning.)