Chapter 7: Risk Mitigation Controls
A large enterprise providing information services or critical infrastructure presents a large attack surface. We must consider all aspects of security, including application vulnerabilities and the likelihood that we will be attacked (always think worst-case scenario). We must be aware of the kind of attacks to expect and, most importantly, how to mitigate these threats. We must be proactive in our approach, using the latest tools and techniques to best protect our assets. We must also consider physical security. But most importantly, we should deploy defense in depth.
In this chapter, we will go over the following topics:
- Understanding application vulnerabilities
- Assessing inherently vulnerable systems/applications
- Recognizing common attacks
- Proactive and detective risk reduction
- Applying preventative risk reduction
