CAS-003 · Question #744
A company has made it a spending priority to implement security architectures that will be resilient during an attack. Recent incidents have involved attackers leveraging latent vulnerabilities in…
The correct answer is D. Upgrade the cryptographic ciphers used on the VPN concentrators. The scenario specifically describes attackers exploiting cryptographic implementation weaknesses and VPN concentrator vulnerabilities with slow patch availability. Upgrading to stronger, modern cryptographic cipher suites directly reduces the exploitable attack surface for the…
Question
A company has made it a spending priority to implement security architectures that will be resilient during an attack. Recent incidents have involved attackers leveraging latent vulnerabilities in cryptographic implementations and VPN concentrators to be able to compromise sensitive information. Patches have been slowly released for these emergent vulnerabilities, leaving weeks to months of exposed and vulnerable attack surface. Which of the following approaches would be BEST to increase enterprise resilience during similar future attacks?
Options
- AImplement appliances and software from diverse manufacturers
- BSegment remote VPN users logically from the production LAN
- CMaximize open-source software to benefit from swifter patch releases
- DUpgrade the cryptographic ciphers used on the VPN concentrators
How the community answered
(52 responses)- A29% (15)
- B6% (3)
- C10% (5)
- D56% (29)
Explanation
The scenario specifically describes attackers exploiting cryptographic implementation weaknesses and VPN concentrator vulnerabilities with slow patch availability. Upgrading to stronger, modern cryptographic cipher suites directly reduces the exploitable attack surface for the exact vulnerability class described. Weak or deprecated ciphers (e.g., RC4, DES, weak RSA parameters) are well-understood targets; migrating to robust modern ciphers (e.g., AES-256, ChaCha20, ECDH) eliminates those vectors without waiting for vendor patches. Vendor diversification (A) is a valid resilience strategy but does not address the cryptographic flaw directly. Logical segmentation of VPN users (B) limits blast radius but does not fix the underlying vulnerability. Maximizing open-source software (C) does not reliably guarantee faster patch cycles.
Topics
Community Discussion
No community discussion yet for this question.