6 Mitigation and Defensive Response Free Online FlashCards

What is the purpose of a security control?

Security controls are safeguards that reduce the likelihood or impact of an attack.

How should a control be linked to a risk?

Trace the threat actor or event to its attack method, the vulnerability or exposure, the affected asset and impact, then choose a control.

What do preventive controls do?

Preventive controls make attacks less likely or limit opportunities to succeed, such as patching vulnerable software or requiring MFA.

What do detective controls do?

Detective controls identify suspicious activity or control failures quickly, using measures such as log monitoring and vulnerability scans.

What do responsive controls do?

Responsive controls limit damage, remove the cause, and restore safe operations—for example, isolating affected devices or restoring clean backups.

How can network segmentation support both prevention and detection?

Segmentation can prevent attackers from moving freely between network areas and make unusual connections easier to detect.

What factors help prioritize mitigations?

Consider potential impact, likelihood and exposure, asset importance, control effectiveness and feasibility, and residual risk or dependencies.

What can teams do when an exposed vulnerability cannot be patched immediately?

Limit access, isolate vulnerable systems, disable services, or increase monitoring until a permanent fix is possible.

Which controls address phishing that could steal employee credentials?

Use phishing-resistant MFA where feasible, remove unnecessary privileges, and alert on unusual sign-ins or unexpected privilege changes.

Why should an indicator of compromise be interpreted in context?

An IOC can guide detection or investigation, but it must be interpreted in context; one alert may be benign, while related signals may indicate broader compromise.

Why collect logs centrally and protect them?

Centralized logs support detection and response; protecting them against unauthorized access or tampering preserves their usefulness as evidence.

What is the practical sequence for responding to an incident?

Triage, contain, eradicate, recover, and review.