Building Practical Mitigations

Knowing attacks is only half the job; applying mitigations is the rest. A mitigation is any measure that reduces the likelihood or impact of a threat. No control stops everything, so you layer many to cut overall risk.

This lesson gathers the practical, everyday defenses a technician applies to harden a network against the attacks you have studied.

Patch management is one of the most effective defenses. Most attacks exploit known vulnerabilities that already have fixes. Applying security updates promptly to operating systems, applications, and network gear closes those holes.

Automated patching and a regular update schedule keep systems current, dramatically shrinking the window in which attackers can use a known exploit against you.

Weak or reused passwords cause countless breaches. Enforce strong, unique passwords and add MFA (Multi-Factor Authentication), which requires a second proof, like a phone code, beyond the password.

MFA is one of the highest-value defenses available: even if an attacker steals a password through phishing, they still cannot log in without the second factor in hand.

Apply the principle of least privilege: give each user and service only the access they need. If an account is compromised, limited rights limit the damage and contain lateral movement.

Regularly review permissions, remove unused accounts promptly, and separate administrative accounts from everyday ones so a routine compromise does not hand over admin power.

Use firewalls with a default-deny stance to permit only needed traffic, and segment the network so a breach in one area cannot spread freely. Isolate guests, IoT devices, and sensitive systems onto separate segments.

These network controls contain incidents, turning what could be a network-wide compromise into a contained problem in a single segment.

Encrypt data in transit (HTTPS, VPNs, encrypted Wi-Fi) and at rest (encrypted drives and databases). Encryption defeats eavesdropping and on-path attacks and renders stolen data useless without the key.

Making encryption the default everywhere means that intercepted traffic and stolen disks yield only scrambled, worthless data to an attacker.

Deploy antivirus or EDR (Endpoint Detection and Response) on devices to catch malware, and email filtering to block phishing and malicious attachments before they reach inboxes.

Since email is the top delivery method for attacks, strong spam and phishing filters paired with endpoint protection stop a large share of threats automatically before users ever see them.

You cannot stop what you cannot see. Use IDS/IPS (Intrusion Detection/Prevention Systems), centralized logging, and a SIEM (Security Information and Event Management) to spot suspicious activity quickly.

Establishing normal baselines lets monitoring flag anomalies, and fast detection limits how much damage an attacker can do before being stopped.

Reliable backups are the ultimate defense against ransomware and data loss. Follow the 3-2-1 rule: three copies, on two media types, with one off-site or offline.

Test restores regularly, because an untested backup may fail when you need it most. With good backups, even a successful attack becomes a recoverable event rather than a disaster.

Technical controls are not enough when attacks target people. Ongoing security awareness training, clear policies, and an incident response plan turn users into a defensive layer and ensure a fast, organized reaction when something goes wrong.

A trained workforce that knows how to spot and report suspicious activity is one of the most cost-effective defenses of all.

Effective security layers many practical mitigations: patching, MFA, least privilege, firewalls and segmentation, encryption, endpoint and email protection, monitoring, backups, and training. No single measure is enough, but together they make attacks far harder to launch, spread, and succeed.

Test your mitigation knowledge.

Practical mitigations layer up to reduce risk: patch management, MFA and strong authentication, least privilege, firewalls and segmentation, encryption everywhere, endpoint and email protection, monitoring (IDS/IPS, SIEM), tested backups (3-2-1), and user training. No control is enough alone.