GCFA · Question #184
Adam works as a Security Administrator for Umbrella Technology Inc. He reported a breach in security to his senior members, stating that "security defenses has been breached and exploited for 2…
The correct answer is C. Disable VPN access to all employees of the company from home machines. Because the attacker gained entry through a compromised employee home machine connected via VPN, disabling VPN access from home machines eliminates that specific attack vector.
Question
Adam works as a Security Administrator for Umbrella Technology Inc. He reported a breach in security to his senior members, stating that "security defenses has been breached and exploited for 2 weeks by hackers." The hackers had accessed and downloaded 50,000 addresses containing customer credit cards and passwords. Umbrella Technology was looking to law enforcement officials to protect their intellectual property. The intruder entered through an employee's home machine, which was connected to Umbrella Technology's corporate VPN network. The application called BEAST Trojan was used in the attack to open a "back door" allowing the hackers undetected access. The security breach was discovered when customers complained about the usage of their credit cards without their knowledge. The hackers were traced back to Shanghai, China through e-mail address evidence. The credit card information was sent to that same e-mail address. The passwords allowed the hackers to access Umbrella Technology's network from a remote location, posing as employees. Which of the following actions can Adam perform to prevent such attacks from occurring in future?
Options
- AApply different security policy to make passwords of employees more complex.
- BReplace the VPN access with dial-up modem access to the company's network.
- CDisable VPN access to all employees of the company from home machines.
- DAllow VPN access but replace the standard authentication with biometric authentication.
How the community answered
(25 responses)- A4% (1)
- B8% (2)
- C80% (20)
- D8% (2)
Why each option
Because the attacker gained entry through a compromised employee home machine connected via VPN, disabling VPN access from home machines eliminates that specific attack vector.
Increasing password complexity would not have prevented this attack because the Trojan (BEAST) created a backdoor, bypassing standard authentication entirely rather than cracking passwords.
Replacing VPN with dial-up modem access does not resolve the underlying problem of unmanaged home machines having direct network access, and introduces other security and operational drawbacks.
The root cause of the breach was a BEAST Trojan installed on an employee's personal home machine, which was granted full VPN access to the corporate network. Disabling VPN access from home machines directly removes the attack vector that was exploited, preventing a recurrence of the same intrusion path. Home machines cannot be managed or secured by corporate policy, making them an inherently higher-risk access point.
Adding biometric authentication would strengthen identity verification but would not prevent a Trojan already running on the home machine from tunneling through an authenticated VPN session on behalf of the attacker.
Concept tested: VPN remote access risk from unmanaged home machines
Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-77.pdf
Topics
Community Discussion
No community discussion yet for this question.