CAS-001 · Question #430
The risk manager is reviewing a report which identifies a requirement to keep a business critical legacy system operational for the next two years. The legacy system is out of support because the…
The correct answer is B. Segment the device on its own secure network. Because the system is a proprietary embedded device with no vendor support, no available patches, and little documentation, many standard remediation options are off the table. Installing antivirus or a HIDS (C) is impractical on an embedded system where third-party software…
Question
The risk manager is reviewing a report which identifies a requirement to keep a business critical legacy system operational for the next two years. The legacy system is out of support because the vendor and security patches are no longer released. Additionally, this is a proprietary embedded system and little is documented and known about it. Which of the following should the Information Technology department implement to reduce the security risk from a compromise of this system?
Options
- AVirtualize the system and migrate it to a cloud provider.
- BSegment the device on its own secure network.
- CInstall an antivirus and HIDS on the system.
- DHire developers to reduce vulnerabilities in the code.
How the community answered
(44 responses)- A7% (3)
- B80% (35)
- C11% (5)
- D2% (1)
Explanation
Because the system is a proprietary embedded device with no vendor support, no available patches, and little documentation, many standard remediation options are off the table. Installing antivirus or a HIDS (C) is impractical on an embedded system where third-party software cannot be installed. Hiring developers (D) is unfeasible given how little is known about the codebase. Virtualizing and migrating to the cloud (A) is risky and likely impossible for a proprietary embedded system. The best compensating control is to segment the device on its own isolated secure network (B), limiting lateral movement and reducing the attack surface if the system is compromised - a classic network-level compensating control for unsupported systems.
Topics
Community Discussion
No community discussion yet for this question.