Technical controls are the software and hardware mechanisms that enforce security policy. While administrative controls guide people, technical controls automate defence—blocking malicious traffic, detecting intrusions, and protecting data at rest and in transit. We’ll explore the core quartet: firewalls, IDS/IPS, encryption, and multi‑factor authentication.
Firewalls filter traffic based on rules (allow/deny). Stateful firewalls track connection state; next‑gen firewalls (NGFW) inspect application layer data. A well‑crafted rule set follows the principle of least privilege—deny all, then permit only what’s necessary.
An Intrusion Detection System (IDS) monitors traffic and alerts on suspicious patterns; an Intrusion Prevention System (IPS) can also block that traffic. Signature‑based systems match known attack patterns; anomaly‑based systems use baselines. Both produce logs that are invaluable for incident response.
Deploying an IPS in ‘monitor only’ mode for the first weeks helps tune out false positives before you accidentally block legitimate traffic.
# Suricata IPS rule example: drop packets to known C2 IP
# /etc/suricata/rules/custom.rules
drop ip $HOME_NET any -> 203.0.113.99 any (msg:"Malicious C2 server"; sid:1000001; rev:1;)The rule above drops any outgoing packet to a known command‑and‑control server. Threat intelligence feeds keep these IP lists updated.
Encryption transforms plaintext into ciphertext using algorithms (AES, RSA, ECC). In transit (TLS) and at rest (disk/DB encryption), it ensures that even if attackers steal data, they can’t read it. Key management is the hard part—lose the keys, lose the data.
| Encryption Type | Algorithm Example | Use Case |
|---|---|---|
| Symmetric | AES‑256 | File/database encryption |
| Asymmetric | RSA 2048 | Key exchange, digital signatures |
| Hashing | SHA‑256 | Password storage (with salt) |
| TLS | ECDHE‑AES‑GCM | Web traffic encryption |
MFA requires at least two of: something you know (password), something you have (token), or something you are (biometric). It drastically reduces credential‑based attacks. Even if passwords are phished, the attacker lacks the second factor. Time‑based One‑Time Passwords (TOTP) and FIDO2 security keys are gold standards.
💡 Enforce MFA for all privileged accounts and remote access. SMS‑based MFA is better than nothing but vulnerable to SIM swap—prefer authenticator apps or hardware keys.
Verify exercises to earn ★ 160 XP and unlock next lab level.