In the Discovery phase of a cyber attack, attackers attempt to map the network, identify vulnerabilities, and gather information.FirewallandIntrusion Prevention System (IPS)are the most effective security controls to mitigate threats associated with this phase:
* Firewall:The firewall restricts unauthorized network access, blocking suspicious or unexpected traffic that could be part of reconnaissance efforts.
* IPS:Intrusion Prevention Systems detect and prevent suspicious traffic patterns that might indicate scanning or probing activity, which are common in the Discovery phase.
Together, these controls limit attackers' ability to explore the network and identify potential vulnerabilities.