A security analyst works for a defense contractor that produces classified research on drones. The contractor faces nearly constant attacks from sophisticated nation-state actors and other APIs…

Using diverse, heterogeneous components across multiple architectural layers reduces the effectiveness of sophisticated nation-state attacks by preventing a single exploit from compromising the entire system.

Enterprise Security Architecture

Question

A security analyst works for a defense contractor that produces classified research on drones. The contractor faces nearly constant attacks from sophisticated nation-state actors and other APIs. Which of the following would help protect the confidentiality of the research data?

Options

AUse diverse components in layers throughout the architecture
BImplement non-heterogeneous components at the network perimeter
CPurge all data remnants from client devices' volatile memory at regularly scheduled
DUse only in-house developed applications that adhere to strict SDLC security

Why each option

AUse diverse components in layers throughout the architecture

BImplement non-heterogeneous components at the network perimeter

Non-heterogeneous (homogeneous) components create a monoculture at the perimeter, meaning a single known vulnerability or zero-day exploit can compromise the entire boundary layer simultaneously.

CPurge all data remnants from client devices' volatile memory at regularly scheduled

Purging volatile memory (RAM) on a scheduled basis does not protect against active real-time exfiltration by nation-state actors - volatile memory already loses data when powered off, and scheduled purges do not address live confidentiality threats.

DUse only in-house developed applications that adhere to strict SDLC security

Exclusively using in-house developed applications reduces third-party supply chain risk but does not provide layered or diverse defenses, and in-house development alone does not counter the advanced persistent threat techniques employed by nation-state actors.

Concept tested: Defense in depth with heterogeneous component diversity

Source: https://csrc.nist.gov/publications/detail/sp/800-160/vol-2/rev-1/final

Topics

#defense in depth#APT defense#data confidentiality#security architecture

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice