Rank the controls by what they actually prevent, and implement the top three

short · 40 min · Objective 2.2

Task

Produce an honest ranking of preventive controls against what each one stops, then implement the three highest-ranked on a machine and verify each. The ranking is the exercise, because the controls people spend money on are not the ones that prevent the most.

Steps

  1. Write lab/prevent/ranking.csv with header control,what_it_prevents,what_it_misses,cost,rank covering patching, least privilege, allow-listing, macro settings, endpoint protection, mail filtering, web filtering and user education.
  2. Audit a machine's patch position in lab/prevent/patches.csv with header component,version,current,last_updated covering the operating system, browser, document reader, runtimes and anything with a network service.
  3. Implement the top three controls on the guest and record how you verified each in lab/prevent/implemented.csv with header control,how_configured,verified_by.
  4. Confirm the endpoint protection configuration in lab/prevent/endpoint.csv with header setting,value,why covering real-time protection, definition updates, scheduled scan timing, tamper protection and where alerts go.
  5. Write lab/prevent/education.md giving the one habit you would teach a user, and two things you would not say, with why each of those backfires.

Verify

awk -F, 'NR>1 && NF>=5 {n++} END {print n" control(s) ranked"}' lab/prevent/ranking.csv
awk -F, 'NR>1 && $5==1 {print $1}' lab/prevent/ranking.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" component(s) patch-checked"}' lab/prevent/patches.csv
awk -F, 'NR>1 && NF>=3 {n++} END {print n" control(s) implemented"}' lab/prevent/implemented.csv
awk -F, 'NR>1 && NF>=3 {n++} END {print n" endpoint setting(s)"}' lab/prevent/endpoint.csv
grep -Eic 'verify|channel you chose|check' lab/prevent/education.md

Eight controls ranked, five components patch-checked, three implemented and verified, and five endpoint settings. The rank-1 control printed by the second command is your claim about what prevents the most -- be prepared to defend it.

Notes

If patching is not at or near the top of your ranking, the ranking is wrong. The overwhelming majority of successful attacks on ordinary machines use vulnerabilities that were patched before the attack happened.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.