6 Mitigation and Defensive Response

Connect controls to security risk

Security controls are safeguards that reduce the likelihood or impact of an attack. A strong defense connects each control to a specific threat, vulnerability, or indicator of compromise (IOC), rather than applying controls without considering the risk.

The NIST Cybersecurity Framework groups cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. These functions work together rather than as isolated steps.

Understand the purposes of mitigation

Mitigations serve three purposes, and a single control can support more than one purpose.

• Preventive: Make an attack less likely or limit opportunities to succeed. Examples include patching vulnerable software, requiring multifactor authentication (MFA), removing unnecessary services, restricting permissions, and segmenting networks.

• Detective: Identify suspicious activity or control failures quickly. Examples include centralizing and protecting logs, monitoring endpoint and network alerts, reviewing unusual sign-ins, and scanning for vulnerabilities.

• Responsive: Limit damage, remove the cause, and restore safe operations. Examples include disabling compromised accounts, isolating affected devices, preserving evidence, eradicating malware, patching exploited weaknesses, and restoring clean backups.

These categories can overlap. Network segmentation can make it harder for an attacker to move freely and can also make unusual connections easier to detect. Backups support response and recovery; they are most useful when protected from unauthorized alteration and tested regularly.

Trace threats to controls

Start a control decision with a clear risk chain:

Threat actor or event → attack method → vulnerability or exposure → affected asset and impact → control

For example, a credential-stealing actor may target employees through phishing. If a stolen password provides access to email and administrator tools, the weakness may extend beyond the password to missing MFA, excessive privileges, and insufficient sign-in monitoring.

Controls should address those weaknesses directly:

• Prevent: Use phishing-resistant MFA where feasible, remove unnecessary privileges, and train staff to report suspicious messages.

• Detect: Alert on unusual sign-ins, new forwarding rules, and unexpected privilege changes.

• Respond: Disable affected sessions and accounts, investigate mailbox activity, reset credentials, and remove unauthorized rules.

A control is most valuable when it breaks an important link in the attack chain or limits consequences if another control fails. A layered approach combines prevention to reduce opportunities, detection to shorten the time an attacker can operate, and response to limit harm.

Prioritize mitigations

Not every weakness can be fixed immediately. Prioritize work by considering:

1. Potential impact: Could exploitation expose sensitive data, disrupt an essential service, or affect many systems?

2. Likelihood and exposure: Is the asset reachable from the internet or widely accessible? Is there evidence that attackers are exploiting the weakness?

3. Asset importance: Does the system support a critical business function, hold valuable data, or provide privileged access to other systems?

4. Control effectiveness and feasibility: How much risk will the control reduce, how quickly can it be applied, and could it disrupt operations?

5. Dependencies and residual risk: What risk remains after applying the control, and are temporary safeguards needed until permanent remediation is possible?

Risk assessment supports informed decisions about how to respond to risk. Actively exploited vulnerabilities on exposed or critical systems deserve urgent attention. If immediate patching is not possible, interim measures can include limiting access, isolating vulnerable systems, disabling services, or increasing monitoring.

Match controls to common weaknesses

Controls should fit the system’s role and operational requirements. The examples below are starting points, not universal prescriptions.

Stolen or reused passwords

• Prevent: Require MFA and unique passwords, apply least privilege, and disable unused accounts.

• Detect: Alert on unusual locations, devices, or sign-in patterns.

• Respond: Revoke sessions, disable or reset accounts, and investigate accessed resources.

Unpatched internet-facing software

• Prevent: Maintain an asset inventory, patch promptly, remove unnecessary services, and restrict exposure.

• Detect: Scan for vulnerabilities and monitor exploit attempts and service changes.

• Respond: Isolate affected systems, apply patches or compensating configuration, and verify remediation.

Malware or ransomware

• Prevent: Limit execution privileges, restrict unnecessary network paths, and keep protected, tested backups.

• Detect: Use endpoint alerts and centralized security logs; monitor unusual encryption or file changes.

• Respond: Isolate affected hosts, preserve evidence, remove malware or rebuild from a trusted source, and restore verified data.

Excessive network access

• Prevent: Segment networks, allow only required connections, and apply least privilege.

• Detect: Monitor unexpected connections and lateral movement.

• Respond: Block malicious traffic, isolate affected segments, and review and reduce access.

Phishing and social engineering

• Prevent: Use phishing-resistant MFA, user reporting procedures, and email security controls.

• Detect: Analyze reported messages and suspicious sign-ins; monitor mailbox-rule changes.

• Respond: Remove malicious messages where possible, revoke access, and investigate affected accounts and devices.

Consider operational consequences when choosing a response. Disconnecting a compromised workstation may be appropriate, while abruptly shutting down a safety-critical operational technology system could create additional danger. Coordinate high-impact actions with responsible technical and business owners.

Use indicators and logs effectively

An indicator of compromise (IOC), such as a malicious file hash, suspicious domain, unexpected process, or unusual account activity, can help detect or investigate a specific incident. Interpret indicators in context: one alert may be benign, while several related signals may indicate a broader compromise.

Detection procedures should specify who reviews alerts, what evidence to preserve, when to escalate, and which preapproved containment actions are safe to take. Logs are especially useful when collected centrally and protected against unauthorized access or tampering; centralized, secure log storage supports detection and incident response.

Respond, recover, and improve

A practical response sequence is:

1. Triage: Confirm the alert, determine likely scope and impact, and notify the appropriate responders.

2. Contain: Limit further access or spread while preserving evidence and considering operational impact.

3. Eradicate: Remove malicious components, close the exploited weakness, and address persistence or compromised credentials.

4. Recover: Restore systems and services from trusted sources, then verify that they operate securely.

5. Review: Record what happened, assess whether controls worked, and update procedures and safeguards.

Response plans should be prepared before an incident. They should identify decision-makers, contacts, escalation paths, evidence-handling procedures, and recovery priorities. After an incident, address the vulnerabilities or conditions that enabled it and use the lessons learned to improve controls.