Hardening that matters
Patching, MFA, least privilege, backups: the controls that end most incidents.
Most incidents end at one of four controls. Organizations bleed when they buy the fifth control before finishing the first four. Check in this order, fix in this order, report in this order.
1. MFA on every remote and admin login
The single control that kills password attacks outright — brute force, spraying, and stuffing all die at the second factor, including with correct passwords. Coverage must include email (the password-reset skeleton key), VPN, admin panels, and code hosting. Partial MFA is a finding with a map: enumerate the logins without it and list them by exposure.
Prefer phishing-resistant factors (security keys, passkeys) for admins; authenticator apps beat SMS, and SMS beats nothing. Document the exceptions — every MFA gap needs a named owner and a date.
2. Patching, ordered by exposure
Patch internet-facing and known-exploited (KEV-listed) systems first, everything else on cadence. Exposure × exploitability beats every other ordering: a KEV vulnerability on a public server outranks ten theoretical flaws on an isolated workstation. Track mean-time-to-patch for the KEV set — it is the one patching number executives should see.
3. Least privilege
Every account holds only the access its job needs, so one compromise stays one compromise. Review in three places: standing admin rights (convert to just-in-time elevation), service accounts (scope to the exact APIs, rotate on schedule), and departed users (deprovision within a day — stale accounts are free entry). When one account falls, least privilege decides how far the fall goes.
4. Backups that are tested and offline
Ransomware hunts connected backups first, so at least one copy must be offline or immutable — and untested backups are hopes, not controls. Restore on schedule, time the restore (recovery-time promises need measured numbers), and keep the runbook where the incident team can reach it when the file shares are down.
Key takeaways
- Order beats completeness: MFA → exposure-ordered patching → least privilege → offline tested backups.
- Every gap gets a named owner and a date, or it is not a plan.
- Measure: MFA coverage %, KEV patch time, stale accounts, last restore test.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.