Certified: The Security+ Prepcast

In our last episode, we talked about two major components of vulnerability remediation: structured patch management and the role of cyber insurance in risk transfer. But patching is not always an immediate option. Maybe a fix is not available. Maybe the system cannot be taken offline. Or maybe remediation requires time, coordination, or vendor involvement. That is where other forms of response come into play. In this episode, we continue our discussion on vulnerability response and remediation by exploring two powerful strategies: network and system segmentation, and the use of compensating controls and managed exceptions.
Let’s begin with segmentation. Network and system segmentation is the practice of dividing your network or infrastructure into smaller, isolated sections to reduce risk and limit the spread of threats. Segmentation does not eliminate vulnerabilities—it contains them. If one part of your network is compromised, segmentation helps ensure that the attacker cannot move laterally and reach other critical systems.
There are different types of segmentation. At the network level, segmentation may involve creating virtual local area networks, using firewalls to block traffic between zones, or applying access control lists to restrict communication. At the system level, segmentation might involve placing applications in separate containers, using virtual machines, or isolating systems based on sensitivity or role.
The goal is to enforce the principle of least privilege—not just for users, but for systems as well. For example, a payment processing server does not need to communicate with a marketing file share. An accounting workstation should not have access to development servers. By applying tight boundaries between systems and restricting unnecessary communication, segmentation reduces the blast radius of any breach.
Let’s look at a real-world case study. A university deploys network segmentation across its campus. They create separate zones for student labs, faculty workstations, administrative offices, and public Wi-Fi. When a malware outbreak hits a student lab, the infection is unable to reach the faculty and administrative systems. Segmentation contains the threat and limits the damage. Incident response is faster, more focused, and less disruptive to operations.
In another example, a manufacturing company segments its industrial control systems from its business network. This protects factory equipment from email-based attacks and internet-borne threats. Even if an employee opens a phishing attachment on their workstation, the malware cannot reach the production line. This segmentation strategy ensures the safety and availability of critical infrastructure while the IT team works to contain the breach.
Segmentation also supports compliance with standards like the Payment Card Industry Data Security Standard, which requires isolating cardholder data environments from the rest of the network. Many data privacy regulations now expect or mandate segmentation as part of a layered security strategy. It is not just a technical best practice—it is becoming a baseline expectation for responsible risk management.
Now let’s move to compensating controls and managed exceptions. Sometimes, you cannot patch a vulnerability or make the ideal fix. Maybe the vendor no longer supports the product. Maybe the change would break a mission-critical workflow. In these cases, compensating controls come into play. A compensating control is an alternative security measure that reduces the risk associated with a known vulnerability when direct remediation is not feasible.
Compensating controls must meet the same security objective as the original fix. They do not have to be identical, but they must effectively mitigate the risk to an acceptable level. For example, if a system cannot be patched for a remote code execution flaw, a compensating control might be to block the vulnerable port at the firewall, disable unnecessary services, or enforce multifactor authentication on all access to the system.
Another common compensating control is enhanced monitoring. If you cannot fix the vulnerability immediately, you can increase log collection, set up custom alerts, or implement file integrity monitoring to detect suspicious activity. These measures do not remove the vulnerability, but they make it much harder for an attacker to exploit it undetected.
In practical terms, compensating controls should be documented, reviewed, and approved through a formal process. This ensures that security teams, system owners, and auditors are all aware of the risk and the steps being taken to manage it. Documentation should include the reason the vulnerability cannot be directly remediated, the specific controls in place, and a timeline for future review or re-evaluation.
Let’s explore a scenario. A hospital is using a legacy medical device that runs on an outdated operating system. The vendor is no longer releasing patches, and upgrading the system would require replacing expensive hardware. As a compensating control, the hospital isolates the device on its own network segment, disables all unnecessary ports, blocks internet access, and requires access through a jump server with strict logging. While not a perfect solution, this strategy greatly reduces the risk and keeps the device functional until a replacement is feasible.
Now let’s talk about exceptions and exemptions. An exception is a temporary allowance to not fix a vulnerability immediately. An exemption is a longer-term or permanent decision to not remediate a specific issue. Both must be handled carefully to avoid creating unmanaged risk.
Exceptions should always be time-bound. They are granted for situations where remediation is delayed for a valid reason, such as waiting for a patch, coordinating across departments, or completing a migration project. Exceptions must be documented, include a clear expiration date, and list the compensating controls being used in the meantime. Without these requirements, exceptions can become permanent and forgotten—which turns a known risk into an unmanaged one.
Exemptions require even more scrutiny. They may be used when a system is being retired, a service is read-only and not externally accessible, or the cost of remediation outweighs the risk. But exemptions must still include documentation, risk assessment, and formal approval. Ideally, exemptions are reviewed periodically to see if conditions have changed. What was acceptable last year may no longer be appropriate under new regulations or business priorities.
In both cases, communication is key. Security teams must work closely with business units to explain the risks, review the controls, and ensure that leadership understands the decisions being made. Exceptions and exemptions are not just technical decisions—they are business decisions that should be made with full awareness of the tradeoffs.
To summarize, vulnerability response goes beyond patching. Network and system segmentation reduce the impact of vulnerabilities by limiting lateral movement and enforcing boundaries. Compensating controls provide alternative protections when direct fixes are not possible. Exceptions and exemptions allow for flexibility, but must be managed with clear documentation, review processes, and appropriate oversight. Together, these strategies allow organizations to manage complex environments and reduce risk even when ideal remediation is delayed.
For the Security Plus exam, be ready to identify examples of segmentation, define compensating controls, and explain how exceptions and exemptions are handled securely. Expect scenario-based questions that challenge you to choose the right combination of controls when patching is not immediately possible. Review terms like isolation, monitoring, firewall policy, risk acceptance, and mitigation strategy—they are all fair game on the exam.