Countermeasures, Hardening, and Mitigation Controls
Countermeasures, Hardening, and Mitigation Controls tests whether you can choose the control that actually removes an attack path, implement it without breaking production, and explain the residual risk when you cannot. Items favor specific configuration knowledge over the word 'defense in depth'.
Control families and specifics
- Identity: phishing-resistant MFA (FIDO2) rather than push-based, Conditional Access, LAPS for local administrator passwords, Protected Users group, tiered administration with privileged access workstations, and disabling NTLM and legacy authentication where possible.
- Endpoint: Credential Guard, LSASS protection (RunAsPPL), WDAC or AppLocker allowlisting, attack surface reduction rules such as blocking Office child processes and script downloads, tamper protection on the EDR agent, macro blocking from internet sources, controlled folder access.
- Network: segmentation and microsegmentation, deny-by-default egress filtering, DNS filtering, SMB signing, disabling SMBv1, LLMNR and NetBIOS name resolution poisoning paths, proxy enforcement.
- Email and web: SPF, DKIM and DMARC at enforcement, attachment sandboxing, link rewriting.
- Data and recovery: 3-2-1 backups with at least one immutable or offline copy, tested restores, encryption at rest, honeytokens for early warning.
- Vulnerability prioritization: CVSS for severity, EPSS for exploitation likelihood, CISA KEV for confirmed exploitation - patch what is being exploited first.
Worked example
Credential dumping keeps succeeding on servers. Reasoning: RunAsPPL moves LSASS behind a protected-light process so unsigned or non-PPL callers cannot read it; the ASR rule blocking credential stealing from LSASS adds a second layer; Credential Guard isolates derived secrets in virtualization-based security so even a successful dump yields less. Each control removes part of the path, and none is sufficient alone. The residual risk - a signed vulnerable driver loaded as a kernel service - must be documented and covered by a driver blocklist and monitoring for service creation.
Traps that cost marks
Letting hardening exceptions accumulate until the baseline is fiction. Deploying controls in audit mode indefinitely instead of enforcing. Assuming an EDR alert means an EDR block. Forgetting that compensating controls must be documented, or the residual risk is invisible to auditors and to responders.