2 cissp ® Official Study Guide Eighth Edition

Basic Preventive Measures 
While there is no single step you can take to protect against all attacks, there are some 
basic steps you can take that go a long way to protect against many types of attacks. Many 

---

746
Chapter 17 
■
Preventing and Responding to Incidents
of these steps are described in more depth in other areas of the book but are listed here as 
an introduction to this section. 
Keep systems and applications up-to-date.
Vendors regularly release patches to correct 
bugs and security fl aws, but these only help when they’re applied. Patch management 
(covered in Chapter 16, “Managing Security Operations”) ensures that systems and appli-
cations are kept up-to-date with relevant patches. 
Remove or disable unneeded services and protocols.
If a system doesn’t need a service or 
protocol, it should not be running. Attackers cannot exploit a vulnerability in a service or 
protocol that isn’t running on a system. As an extreme contrast, imagine a web server is 
running every available service and protocol. It is vulnerable to potential attacks on any of 
these services and protocols. 
Use intrusion detection and prevention systems.
Intrusion detection and prevention sys-
tems observe activity, attempt to detect attacks, and provide alerts. They can often block or 
stop attacks. These systems are described in more depth later in this chapter. 
Use up-to-date anti-malware software.
Chapter 21, “Malicious Code and Application 
Attacks,” covers various types of malicious code such as viruses and worms. A primary 
countermeasure is anti-malware software, covered later in this chapter. 
Use firewalls.
Firewalls can prevent many different types of attacks. Network-based fi re-
walls protect entire networks and host-based fi rewalls protect individual systems. Chapter 11, 
“Secure Network Architecture and Securing Network Components,” includes information 
on using fi rewalls within a network, and this chapter includes a section describing how fi re-
walls can prevent attacks.