TyscorpaKey Mitigation Strategies
| Strategy | Description | Example |
|---|---|---|
| Patching | Applying vendor updates to close known vulnerabilities | Monthly Patch Tuesday cycle; emergency patch for zero-day |
| Encryption | Protect data at rest and in transit | AES-256 for storage, TLS 1.3 for network traffic |
| Network Segmentation | Dividing network into isolated zones to limit lateral movement | Separating production, dev, and guest networks with VLANs |
| Least Privilege | Grant only the permissions needed to perform a job function | Read-only DB account for reporting applications |
| Allowlisting | Only permitted software/IPs are allowed to run/connect | Application control: only approved executables run |
| Blocklisting / Denylisting | Known-bad items are blocked | Blacklisting malicious IP ranges in firewall |
| Configuration Hardening | Disable unused features, change defaults, apply security baselines | CIS Benchmarks for server/OS hardening |
| MFA | Require multiple authentication factors to prevent credential compromise | Password + authenticator app for VPN access |
| Monitoring & Alerting | Continuous visibility to detect threats early | SIEM detecting brute-force logins; IDS alerts on port scans |
| Decommissioning | Properly retiring end-of-life systems | Securely wiping and removing legacy Windows XP machines |
| Isolation | Completely separating critical or compromised systems | Air-gapping industrial control systems; quarantining infected host |
Defense in Depth
No single control is sufficient. Layer multiple controls so that if one fails, others compensate.
Example — Protecting a web application:
- Perimeter: Edge firewall blocks known-bad IPs
- Network: WAF inspects HTTP traffic for injection attacks
- Host: EDR on the web server detects malicious processes
- Application: Input validation and parameterized queries prevent SQLi
- Data: Database encryption protects data at rest
- Identity: MFA required for admin access
Hardening Techniques
- Remove/disable unnecessary services and software
- Change all default passwords
- Apply security patches promptly
- Enable host-based firewall
- Disable Telnet, FTP — use SSH, SFTP instead
- Enable full-disk encryption (BitLocker, FileVault)
- Enable audit logging on all critical systems
- Use secure configuration baselines: CIS Benchmarks, STIG
Exam Tip: When given a scenario and asked "what BEST mitigates this threat?", use the principle of specificity — the most targeted, precise mitigation always scores over a generic one. Patching beats any workaround. Network segmentation beats monitoring alone. MFA beats strong passwords alone.