8.3 Threat Mitigation

Security settings on hardware and software reduce exposure to threats by restricting unnecessary functionality.

Anti‑malware software:

• Detects and removes malicious software
• Scans files and systems
• Quarantines or deletes threats

Drawbacks: performance impact, reliance on updates.

Intrusion detection systems monitor activity to detect suspected attacks.

Encryption protects data confidentiality:

• Hashing – one‑way data protection
• Symmetric encryption – shared key
• Asymmetric encryption – public/private keys

Drawbacks: key management and performance overhead.

• User access policies restrict system access
• Staff vetting reduces insider threats
• Staff training improves security awareness
• Software‑based access control enforces permissions
• Device hardening removes unnecessary services

Backups:

• Full – complete data copy
• Incremental – changes only
• Differential – changes since last full backup
• Stored securely and offline where possible

Additional controls:

• Software updates and patching
• Firmware and driver updates
• Air gaps to isolate systems

• API certification to ensure secure integration
• VPNs to secure remote access
• Multi‑factor authentication (MFA)
• Password managers to improve password security
• Port scanning to identify exposed services
• Penetration testing:
  • Ethical hacking – authorised testing
  • Unethical hacking – illegal activity

Drawbacks: cost, complexity, resource requirement.

Firewalls control network traffic using rules:

• Inbound and outbound traffic rules
• Traffic type rules
• Application‑specific rules
• IP address‑based rules

These rules reduce unauthorised access.

Network segregation limits the impact of compromise:

• Virtual networks
• Physical separation
• Offline networks

Network monitoring detects abnormal activity, while port scanning identifies exposed services.