nerdexam
GIAC

GCIH · Question #328

Adam works as a Security Administrator for Umbrella Technology Inc. He reported a breach in security to his senior members, stating that "security defenses has been breached and exploited for 2…

The correct answer is C. Disable VPN access to all employees of the company from home machines. The attack entered via an employee's home machine connected to the corporate VPN, where the BEAST Trojan created a persistent backdoor. Disabling home-machine VPN access removes that specific attack vector.

Incident Response & Cyber Kill Chain

Question

Adam works as a Security Administrator for Umbrella Technology Inc. He reported a breach in security to his senior members, stating that "security defenses has been breached and exploited for 2 weeks by hackers." The hackers had accessed and downloaded 50,000 addresses containing customer credit cards and passwords. Umbrella Technology was looking to law enforcement officials to protect their intellectual property. The intruder entered through an employee's home machine, which was connected to Umbrella Technology's corporate VPN network. The application called BEAST Trojan was used in the attack to open a "back door" allowing the hackers undetected access. The security breach was discovered when customers complained about the usage of their credit cards without their knowledge. The hackers were traced back to Shanghai, China through e-mail address evidence. The credit card information was sent to that same e-mail address. The passwords allowed the hackers to access Umbrella Technology's network from a remote location, posing as employees. Which of the following actions can Adam perform to prevent such attacks from occurring in future?

Options

  • AAllow VPN access but replace the standard authentication with biometric authentication
  • BReplace the VPN access with dial-up modem access to the company's network
  • CDisable VPN access to all employees of the company from home machines
  • DApply different security policy to make passwords of employees more complex

How the community answered

(28 responses)
  • A
    4% (1)
  • B
    4% (1)
  • C
    82% (23)
  • D
    11% (3)

Why each option

The attack entered via an employee's home machine connected to the corporate VPN, where the BEAST Trojan created a persistent backdoor. Disabling home-machine VPN access removes that specific attack vector.

AAllow VPN access but replace the standard authentication with biometric authentication

Biometric authentication still permits a compromised home machine to connect - the problem is the infected endpoint itself, not the strength of the authentication method.

BReplace the VPN access with dial-up modem access to the company's network

Replacing VPN with dial-up still allows a Trojan-infected home machine to reach the corporate network, so the root attack vector remains open.

CDisable VPN access to all employees of the company from home machinesCorrect

The compromised home machine was the sole entry point into the corporate network because of its active VPN connection. Disabling VPN access from home machines eliminates the attack vector entirely, preventing a Trojan-infected endpoint from bridging directly into the internal network. This is the most direct mitigation for the described breach scenario.

DApply different security policy to make passwords of employees more complex

Complex password policies cannot stop a Trojan-based backdoor that operates independently of user credentials and bypasses normal authentication entirely.

Concept tested: VPN remote access endpoint security and breach remediation

Source: https://csrc.nist.gov/publications/detail/sp/800-46/rev-2/final

Topics

#VPN security#trojan incident response#remote access controls#breach remediation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice