After a recent outbreak of malware attacks, the Chief Information Officer (CIO) tasks the new security manager with determining how to keep these attacks from reoccurring. The company has a standard…

Adding HIPS and daily AV scans improves detection but does not identify or fix the underlying vulnerabilities in the standard image that enabled the infection.

A vulnerability assessment of the standard image directly surfaces the configuration flaws and unpatched components that allowed the malware outbreak to occur. Remediating those findings hardens the baseline deployed to every workstation, closing the actual attack surface. This addresses the root cause rather than layering detection tools on top of a still-vulnerable image.

Upgrading from NIDS to NIPS is a network-perimeter control and does nothing to remediate host-level weaknesses present in the workstation image.

Rebuilding the image without first assessing it recreates the same insecure baseline, and daily AV scans alone cannot prevent exploitation of unpatched vulnerabilities.