Mitigation covers measures that reduce cybersecurity risk, limit damage from incidents, and help restore secure operations after an attack.
Search across headline titles and summaries.
Background for this topic.
Mitigation is the use of measures that reduce the likelihood or impact of a security threat. In information security, it commonly describes actions taken after a vulnerability, misconfiguration, or active attack is identified, as well as controls planned during system design. Mitigation may lower exposure without removing the underlying weakness; a software patch fixes a vulnerability, while disabling an affected feature or restricting access may provide temporary protection.
Effective mitigation connects vulnerability management with operational decisions: prioritize exposed, exploitable weaknesses on important assets; apply patches or configuration changes; and use compensating controls such as network segmentation, least-privilege access, multifactor authentication, or service isolation when a fix is unavailable. Threat intelligence can help assess exploitation urgency. Controls should be tested and monitored because they can fail or create new exposure. During an incident, containment actions—such as isolating a host or revoking credentials—are mitigations that limit spread while investigation and remediation proceed.
Weekly headline count for the current query.
Silent Patch Tuesday mitigation ends ability to hide malicious commands in .lnk files Microsoft has quietly closed off a critical Windows shortcut file bug long abused by espionage and cybercrime networks.…
FastNetMon says 1.5 Gpps deluge from hijacked routers, IoT kit nearly drowned scrubbing shop A DDoS mitigation provider was given a taste of the poison it tries to prevent, after being smacked by one of the largest packet-rate attacks ever recorded – a 1.5 billion packets per second (1.5 Gpps) flood that briefly threatened to knock it off the internet.…
Researchers had to notify over 100 vendors of flaw that builds on 2023's Rapid Reset with neat twist past usual mitigations Security researchers Gal Bar Nahum, Anat Bremler-Barr, and Yaniv Harel have published details of a "common design flaw" in implementations of the HyperText Transfer Protocol 2 (HTTP/2) allowing those with ill intent to create "massive Denial of Service attacks".…
PLUS: Bluetooth mess leaves cars exposed; Bitcoin ATMs attacked; Deepfakers imitate US secretary of state Marco Rubio; and more Infosec In Brief Nvidia last week advised customers to ensure they employ mitigations against Rowhammer attacks, after researchers found one of its workstation-grade GPUs is susceptible to the exploit.…
Factory resets and apply patches is the advice amid fortnight delay for other appliances The cybersecurity industry is urging those in charge of defending their orgs to take mitigation efforts "seriously" as Ivanti battles two dangerous new vulnerabilities, one of which was already being exploited as a zero-day.…
ALSO: CISA warns Ivanti vuln mitigations might not work, SAML hijack doesn't need ADFS, and crit vulns Infosec in brief The infamous LockBit ransomware gang has been busy in the ten days since an international law enforcement operation took down many of its systems. But despite its posturing, the gang might have suffered more than it's letting on.…
Many versions still without fixes while sophisticated attackers bypass mitigations Ivanti has finally released the first round of patches for vulnerability-stricken Connect Secure and Policy Secure gateways, but in doing so has also found two additional zero-days, one of which is under active exploitation.…
Customers still patchless and mitigation only goes so far There's a "reasonable chance" that Ivanti Connect Secure (ICS) VPN users are already compromised if they didn't apply the vulnerability mitigation released last week, experts say.…
No need to panic, but grab those updates or mitigations anyway just to be safe A vulnerability in the SSH protocol can be exploited by a well-placed adversary to weaken the security of people's connections, if conditions are right.…
Mitigations require mix of updating libraries and manual customer action ownCloud has disclosed three critical vulnerabilities, the most serious of which leads to sensitive data exposure and carries a maximum severity score.…
You need to switch on E2EE in group meetings, watch out for US Cloud Act, warns impact assessment A Data Protection Impact Assessment (DPIA) has been published by a Dutch ministry, noting that Microsoft still has work to do if the country's institutions are to use the company's products without all manner of mitigations.…