Six Mitigation Techniques — Quick Reference
| Technique | Primary Goal | Timing | What It Cannot Do |
|---|---|---|---|
| Patching | Eliminate known exploitable vulnerabilities before attackers use them | Before attack | Does not stop zero-day attacks (no patch exists yet); does not help if credentials are stolen |
| Encryption | Ensure stolen or physically accessed data is unreadable without the key | Before + after | Does not prevent data theft via network; does not help if encryption key is also stolen |
| Monitoring | Detect attacks in progress that preventive controls failed to stop | During attack | Does not prevent a breach; only detects it. Requires human or automated response to act on alerts. |
| Least Privilege | Limit what any single compromised account can access | Before + during | Does not prevent the initial compromise; does not help if a privileged account is the one stolen |
| Config. Enforcement | Prevent non-compliant devices from joining and contaminating the network | Before attack | Does not protect compliant devices from attack; only ensures devices meet a baseline before connecting |
| Decommissioning | Prevent data recovery from retired storage media | After use | Does not protect data while in active use; only addresses retirement-phase residual risk |
Patching Types — When to Deploy
Monthly OS Patches
Regular cadence. Microsoft Patch Tuesday = 2nd Tuesday of each month. Test in staging → approve → deploy via WSUS/SCCM/endpoint management. Most environments have 2–4 week deployment target.
Risk of skipping: Each month compounds — a system unpatched for 6 months has dozens of known exploitable CVEs.
Third-Party App Patches
Irregular cadence per vendor. Browsers (Chrome, Firefox, Edge), PDF readers, Java, Flash (historical), and productivity suites are among the most actively exploited attack surfaces.
Common gap: OS patching is often automated; third-party apps require explicit management and are frequently missed.
Firmware / Driver Patches
Irregular; from hardware manufacturers. BIOS/UEFI, NIC firmware, storage controller, GPU drivers. Often not covered by OS update mechanisms — require vendor tooling.
Risk: Firmware vulnerabilities can survive OS reinstalls and may be below EDR/AV visibility.
Emergency Out-of-Band
Triggered by active exploitation in the wild. Cannot wait for the next maintenance window. Bypasses normal testing cycle. Deploy within hours to days of vendor release.
Exam rule: For actively exploited zero-days, deploy immediately — the risk of running unpatched outweighs the risk of an incompatibility.
Three Encryption Layers — Comparison
| Layer | What Is Encrypted | Technology | Protects Against | Does NOT protect against |
|---|---|---|---|---|
| Full Disk (FDE) | Entire storage volume — OS, apps, user data, swap | BitLocker (Win), FileVault (Mac), LUKS (Linux) | Physical drive theft; unauthorized drive removal; improper decommissioning | Network-based data theft; logged-in user context attacks |
| File-Level | Selected files or folders only | Windows EFS | Other OS accounts accessing the file; drive theft when user is not logged in | Attacker with access to the owning user's account (file auto-decrypts for the user) |
| Application-Level | Application's own stored data (vault file, DB columns, message store) | App-managed (password managers, DB column encryption, encrypted messengers) | Storage compromise at any layer below the app; backup theft; DB file theft | Attacker with access to the running application (data is decrypted in memory during use) |
Posture Assessment Flow
1
Device requests network access — wired (802.1X), wireless (WPA-Enterprise), or VPN connection attempt.
2
Posture agent reports — a NAC client or VPN posture module queries the device and reports its current security state to the enforcement platform.
3
Four checks evaluated: (a) OS patch level ≥ required baseline? (b) EDR installed, running, and signatures current? (c) Host firewall and EDR enabled + correctly configured? (d) Valid machine certificate issued by corporate CA?
✓
All checks pass → device is placed on the production network with full access.
✗
Any check fails → device is placed in the quarantine VLAN. Access only to update/patch servers and remediation portal. No production access.
↻
After remediation (patches applied, EDR updated, firewall enabled) → device resubmits for posture assessment → if passes, moves to production network.
Decommissioning — Method Selection by Scenario
| Scenario | Recommended Method | Sufficient? |
|---|---|---|
| HDD moving to another internal system | Format drive before reassignment; verify no previous user data accessible | Yes — drive stays in organizational custody |
| HDD being donated, resold, or sent to e-recycler | NIST SP 800-88 Purge-level overwrite (multiple-pass, verified) | Yes for most data classifications |
| SSD with BitLocker/FileVault enabled | Cryptographic erase — destroy the BitLocker/FileVault key; ciphertext on drive is permanently unreadable | Yes — fastest and most reliable method for encrypted SSDs |
| SSD without FDE — needs to leave org | ATA Secure Erase command (manufacturer-level) or physical destruction | Standard overwrite not reliable on NAND flash — use manufacturer tool or destroy |
| Drive with classified / highly sensitive data (PHI, PII, financial) | Physical destruction — shred, degauss + shred, or incinerate | Yes — no technique is more certain than physical destruction |
| Discarding without any sanitization | Never acceptable for any organizational device | No — deleted/formatted drives are recoverable with free tools |
Least Privilege — Standard vs. Incorrect Account Model
Incorrect — User Runs as Admin
- User's account has local administrator rights
- Malware executes in user context → inherits admin rights
- Malware can install drivers, disable AV, modify system
- Malware can persist across reboots via system services
- Attacker has full control of the system from day one
Correct — Standard Account + Temporary Elevation
- User's daily account has no admin rights
- Malware executes in user context → limited to user's files
- Malware cannot install drivers or modify system files
- Malware cannot disable security software
- Admin tasks: temporary elevation via UAC/sudo; rights revert after task