Home Solutions Mitigation Resources Contact Us

Mitigation Strategies

Protect Your Business from Cyber Threats

Cyber Threat Mitigation Strategies

The Australian Signals Directorate (ASD) has developed a set of prioritised strategies to help organisations defend against cybersecurity incidents.

These strategies address threats such as targeted cyber intrusions, ransomware, malicious insiders, business email compromise, and attacks on industrial control systems.

If you need assistance implementing these measures, Sentinet is here to help. Contact us today to strengthen your cybersecurity defenses.

Essential Strategies to Mitigate Cyber Security Threats

Regular Backups

Regular backups ensure that your important data, software, and settings are safely stored and can be restored if something goes wrong. This protects your business from data loss due to accidents, cyber attacks, or hardware failures, helping you recover quickly and keep your operations running smoothly.

Restrict Administrative Privileges

Limiting administrative privileges to only those who need them helps protect your business by reducing the risk of accidental or intentional changes that could harm your systems. This keeps your data safe and ensures that only authorised personnel can make important changes.

Multi-factor Authentication

Multi-Factor Authentication (MFA) adds an extra layer of security by requiring users to provide two or more verification methods to access your systems. This reduces the risk of unauthorised access, protecting sensitive data and ensuring that only authorised personnel can perform critical tasks.

Patch Operating Systems

Fix or update computers and network devices with high-risk issues within 48 hours to ensure vulnerabilities are addressed promptly. Avoid using outdated versions, as they may no longer receive security patches, leaving your systems exposed to potential threats.

Patch Applications

Regularly update applications like web browsers, Microsoft Office, Java, and PDF viewers. Fix high-risk issues within 48 hours and always use the latest versions of these applications.

Application Control

Prevent harmful or unauthorised programs from running on your system. This includes blocking executable files, scripts, and installers to keep your system safe from potential threats.

Restrict Microsoft Office Macros

Blocking macros from the internet and only allowing trusted macros helps protect your business from malicious software. This reduces the risk of harmful code running on your systems, keeping your data safe and secure.

User Application Hardening

Disabling unnecessary software features helps secure your business by reducing the number of potential vulnerabilities in your systems. This makes your applications safer and helps protect your sensitive data.

Managed IT Services for the Central Coast, Newcastle & Sydney

Sentinet provides IT services and cyber security threat protection solutions for businesses in the Central Coast, Newcastle and Sydney.

Endpoint Protection Software

Protect devices from cyber threats like malware, ransomware, and phishing. Secure your network with advanced endpoint protection software.

Data Backup and Recovery

Cloud and onsite backup solutions. Safeguard your data against potential disasters like hardware failures, cyber-attacks, or human error.

Technical Support and Training

The Sentinet team offers expert support for your organisation, equipping you with tools to recognise threats and respond swiftly and effectively.

Priority 2 Mitigation Strategies - 'Good'

User education

Prevent Malware Delivery and Execution

User education. Avoid phishing emails (e.g. with links to login to fake websites), weak passphrases, passphrase reuse, as well as unapproved: removable storage media, connected devices and cloud services.

Priority 3 Mitigation Strategies - 'Very good'

Server application hardening

Prevent Malware Delivery and Execution

Server application hardening especially internet-accessible web applications (sanitise input and use TLS not SSL) and databases, as well as applications that access important (sensitive/high-availability) data.

Operating system hardening

Prevent Malware Delivery and Execution

Operating system hardening (including for network devices) based on a Standard Operating Environment, disabling unneeded functionality (e.g. RDP, AutoRun, LanMan, SMB/NetBIOS, LLMNR and WPAD).

Antivirus software using heuristics and reputation ratings

Prevent Malware Delivery and Execution

Antivirus software using heuristics and reputation ratings to check a file’s prevalence and digital signature prior to execution. Use antivirus software from different vendors for gateways versus computers.

Control removable storage media and connected devices

Prevent Malware Delivery and Execution

Control removable storage media and connected devices. Block unapproved CD/DVD/USB storage media. Block connectivity with unapproved smartphones, tablets and Bluetooth/Wi-Fi/3G/4G/5G devices.

Block spoofed emails

Prevent Malware Delivery and Execution

Block spoofed emails. Use Sender Policy Framework (SPF) or Sender ID to check incoming emails. Use ‘hard fail’ SPF TXT and DMARC DNS records to mitigate emails that spoof the organisation’s domain.

Non-persistent virtualised sandboxed environment

Limit the Extent of Cyber Security Incidents

Non-persistent virtualised sandboxed environment, denying access to important (sensitive/high-availability) data, for risky activities (e.g. web browsing, and viewing untrusted Microsoft Office and PDF files).

Software-based application firewall - Incoming

Limit the Extent of Cyber Security Incidents

Software-based application firewall, blocking incoming network traffic that is malicious/unauthorised, and denying network traffic by default (e.g. unneeded/unauthorised RDP and SMB/NetBIOS traffic).

Software-based application firewall - Outgoing

Limit the Extent of Cyber Security Incidents

Software-based application firewall, blocking outgoing network traffic that is not generated by approved/trusted programs, and denying network traffic by default.

Outbound web and email data loss prevention

Limit the Extent of Cyber Security Incidents

Outbound web and email data loss prevention. Block unapproved cloud computing services. Log recipient, size and frequency of outbound emails. Block and log emails with sensitive words or data patterns.

Host-based intrusion detection/prevention system

Detect Cyber Security Incidents and Respond

Host-based intrusion detection/prevention system to identify anomalous behaviour during program execution (e.g. process injection, keystroke logging, driver loading and persistence).

Endpoint detection and response software

Detect Cyber Security Incidents and Respond

Endpoint detection and response software on all computers to centrally log system behaviour and facilitate cyber security incident response activities. Microsoft’s free SysMon tool is an entry level option.

Hunt to discover incidents

Detect Cyber Security Incidents and Respond

Hunt to discover incidents based on knowledge of adversary tradecraft. Leverage threat intelligence consisting of analysed threat data with context enabling mitigating action, not just indicators of compromise.

Business continuity and disaster recovery plans

Recover Data and System Availability

Business continuity and disaster recovery plans which are tested, documented and printed in hardcopy with a softcopy stored offline. Focus on the highest priority systems and data to recover.

System recovery capabilities (virtualisation)

Recover Data and System Availability

System recovery capabilities e.g. virtualisation with snapshot backups, remotely installing operating systems and applications on computers, approved enterprise mobility, and onsite vendor support contracts.

Personnel management

Mitigation Strategy Specific to Preventing Malicious Insiders

Personnel management e.g. ongoing vetting especially for users with privileged access, immediately disable all accounts of departing users, and remind users of their security obligations and penalties.

Priority 4 Mitigation Strategies - 'Excellent'

Automated dynamic analysis of email and web content

Prevent Malware Delivery and Execution

Automated dynamic analysis of email and web content run in a sandbox, blocked if suspicious behaviour is identified (e.g. network traffic, new or modified files, or other system configuration changes).

Email content filtering

Prevent Malware Delivery and Execution

Email content filtering. Allow only approved attachment types (including in archives and nested archives). Analyse/sanitise hyperlinks, PDF and Microsoft Office attachments. Quarantine Microsoft Office macros.

Web content filtering

Prevent Malware Delivery and Execution

Web content filtering. Allow only approved types of web content and websites with good reputation ratings. Block access to malicious domains and IP addresses, ads, anonymity networks and free domains.

Deny corporate computers direct internet connectivity

Prevent Malware Delivery and Execution

Deny corporate computers direct internet connectivity. Use a gateway firewall to require use of a split DNS server, an email server and an authenticated web proxy server for outbound web connections.

Operating system generic exploit mitigation

Prevent Malware Delivery and Execution

Operating system generic exploit mitigation e.g. Data Execution Prevention (DEP), Address Space Layout Randomisation (ASLR) and Enhanced Mitigation Experience Toolkit (EMET).

Disable local administrator accounts

Limit the Extent of Cyber Security Incidents

Disable local administrator accounts or assign passphrases that are random and unique for each computer’s local administrator account to prevent propagation using shared local administrator credentials.

Network segmentation

Limit the Extent of Cyber Security Incidents

Network segmentation. Deny traffic between computers unless required. Constrain devices with low assurance (e.g. BYOD and IoT). Restrict access to network drives and data repositories based on user duties.

Protect authentication credentials

Limit the Extent of Cyber Security Incidents

Protect authentication credentials. Remove CPassword values (MS14-025). Configure WDigest (KB2871997). Use Windows Defender Credential Guard. Change default passphrases. Require long complex passphrases.

Continuous incident detection

Detect Cyber Security Incidents and Respond

Continuous incident detection and response with automated immediate analysis of centralised time-synchronised logs of allowed and denied computer events, authentication, file access and network activity.

Sentinet

Comprehensive Cyber Security Solutions for Business

Website by YourWebspace