PT0-001 · Question #54
A security assessor completed a comprehensive penetration test of a company and its networks and systems. During the assessment, the tester identified a vulnerability in the crypto library used for…
The correct answer is C. Implement an ACL to restrict access to the application exclusively to the finance department. With an unpatched crypto library vulnerability and a vendor fix days away, the best compensating control is to restrict the attack surface by limiting who can reach the vulnerable application. An ACL confining access to the finance department minimizes exposure while the patch…
Question
A security assessor completed a comprehensive penetration test of a company and its networks and systems. During the assessment, the tester identified a vulnerability in the crypto library used for TLS on the company's intranet-wide payroll web application. However, the vulnerability has not yet been patched by the vendor, although a patch is expected within days. Which of the following strategies would BEST mitigate the risk of impact?
Options
- AModify the web server crypto configuration to use a stronger cipher-suite for encryption, hashing,
- BImplement new training to be aware of the risks in accessing the application. This training can be
- CImplement an ACL to restrict access to the application exclusively to the finance department.
- DRequire payroll users to change the passwords used to authenticate to the application. Following
How the community answered
(36 responses)- A8% (3)
- B33% (12)
- C44% (16)
- D14% (5)
Why each option
With an unpatched crypto library vulnerability and a vendor fix days away, the best compensating control is to restrict the attack surface by limiting who can reach the vulnerable application. An ACL confining access to the finance department minimizes exposure while the patch is unavailable.
Modifying the cipher suite configuration does not address the specific crypto library flaw; if the vulnerability is in the library code itself, reconfiguring cipher preferences will not remove the exploitable condition.
User awareness training does not technically reduce the exploitability of a TLS library vulnerability and provides no direct compensating control at the application or network layer.
Implementing an ACL to restrict intranet access exclusively to the finance department limits the blast radius of the unpatched TLS library vulnerability by reducing the population of potential attackers who can reach the application. This compensating control addresses risk at the network-access layer without requiring changes to the vulnerable component itself, and remains effective until the vendor patch is applied.
Requiring password changes does not mitigate a crypto library vulnerability in the TLS stack, because the flaw exists at the transport layer before authentication credentials are evaluated.
Concept tested: Compensating controls for unpatched application vulnerabilities
Source: https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.