Mitigation Techniques - CompTIA Security+ SY0-701 - 2.5

Summary

This Security+ lesson explains mitigation as reducing the impact of a security event or potential attack. It covers several practical techniques:

• Patching: Apply security updates to address known vulnerabilities. Home systems may install patches automatically, while organizations may test them before broad deployment. Emergency patches may be issued when a serious vulnerability is actively exploited.
• Encryption: Protect data at different levels:
  • File-level encryption protects selected files or folders. Windows EFS is one example.
  • Full-disk encryption (FDE) protects an entire storage volume, including the operating system and user files. Examples include BitLocker and FileVault.
  • Applications may also encrypt their own data independently of file-system or disk encryption.
• Monitoring and logging: Collect activity and security logs from network devices, firewalls, intrusion-prevention systems, and operating systems. A SIEM (security information and event manager) can centralize logs for reporting and monitoring.
• Least privilege: Give users only the permissions their roles require. Temporary elevation can provide additional rights when needed. Limiting permissions can restrict the reach of malware or an attacker who compromises an account.
• Posture assessment: Check connecting devices for required security settings, such as current operating-system patches, updated endpoint detection and response (EDR), enabled security tools, and trusted certificates. Noncompliant devices can be quarantined or placed on a private VLAN until they are corrected.
• Secure decommissioning: Remove or clear storage devices before retiring equipment. Drives may be prepared for reuse within the organization or physically destroyed if they are no longer needed and may contain sensitive data.

Reviews or product comparisons: None; this is an instructional overview.

Main speaker/source: Professor Messer.