When developing recommendations for mitigation strategies:
- Consider people, processes, and technology when recommending mitigation strategies.
- Recommend strategies for common findings, such as:
- Shared local administrator credentials: Randomize credentials or use LAPS.
- Weak password complexity: Configure minimum password requirements and use password filters.
- Plaintext passwords: Use protocols that hash or encrypt passwords.
- No multi-factor authentication: Implement or require multi-factor authentication for access to critical systems.
- XSS attacks: Sanitize user input by encoding/escaping special HTML characters.
- SQL injection: Sanitize user input by parameterizing queries.
- Unnecessary open services: Perform system hardening.
- Physical intrusion: Incorporate guards, security cameras, motion alarms, and other physical security defenses.
- Recommend end-user training to mitigate social engineering attacks on end users.
- Recommend system hardening techniques like patch management and firewall configuration to secure hosts.
- Recommend MDM solutions for mobile infrastructure security.
- Recommend SDLC and best coding practices for secure software development.