Simple explanation
Once you know the threats, vectors, vulnerabilities, and indicators — what do you actually DO? This lesson is the "defense toolkit" that ties Domain 2 together.
Technical explanation
- Segmentation — dividing a network into isolated zones so a breach in one doesn't automatically reach the others.
- Access control — enforcing who/what can reach a resource (technical implementation of least privilege).
- Application allow list — only pre-approved software is permitted to run; anything not on the list is blocked by default (stronger than a deny list, which blocks known-bad and allows everything else).
- Isolation — separating a suspicious or high-risk system from the rest of the network entirely.
- Patching — applying vendor fixes to close known vulnerabilities.
- Encryption — protecting data confidentiality even if it's accessed without authorization.
- Monitoring — ongoing observation to catch what prevention missed.
- Least privilege — granting only the minimum access needed for a task.
- Configuration enforcement — ensuring systems stay at an approved secure baseline over time, not just at deployment.
- Decommissioning — properly retiring systems (and their data/access) rather than leaving them forgotten and unpatched.
Hardening techniques specifically: encryption, installing endpoint protection, enabling a host-based firewall, deploying a Host Intrusion Prevention System (HIPS), disabling unnecessary ports and protocols, changing default passwords, and removing unnecessary software — the goal across all of these is reducing attack surface on an individual system.
Synonyms / related terms
| Term | Means | |---|---| | Allow list | Whitelist (older term) | | Deny list | Blacklist (older term) | | Hardening | The general practice of reducing a system's attack surface |
Concept Check
"A company wants to guarantee that only specifically approved applications can execute on finance department workstations, blocking everything else by default, including new/unknown software." This describes an application allow list, not a deny list — a deny list would only block software already known to be bad, while new/unknown threats would still run.
Interview-style Q&A
Q: Why is patching alone not sufficient as a mitigation strategy? A: "Patching addresses known vulnerabilities, but there's always a window between disclosure and patch application — and zero-days have no patch at all. Layered mitigations like segmentation, monitoring, and least privilege reduce impact even when patching hasn't (or can't) close every gap."
Memory trick
"SAIL-PEMC-D" — Segmentation, Access control, application allow-list, Isolation, Least privilege — Patching, Encryption, Monitoring, Configuration enforcement, Decommissioning: ten mitigations, one word-chain.