100-160 Question 197
Select 2A company has identified a vulnerability in its web server that could allow attackers to perform a denial-of-service attack. To address this, the company is considering applying a security patch but is concerned about potential downtime during patching. As a cybersecurity technician, how should the company manage this risk?
- A
Apply the security patch immediately, regardless of the potential downtime.
- B
Evaluate the likelihood and impact of the attack before deciding on patch deployment.
- C
Implement compensating controls, such as a web application firewall (WAF), until the patch can be applied during scheduled maintenance.
- D
Ignore the vulnerability since the attack has not yet occurred.
Show answer and explanation
Correct answers: B, C
Explanation
Risk management involves identifying, assessing, and addressing risks in a way that balances security with operational needs. In this scenario, the correct approach is to evaluate the risk (likelihood and impact) and implement temporary compensating controls, such as a WAF, until the patch can be applied during scheduled maintenance. This ensures the vulnerability is managed while minimizing business disruption.
- A. Incorrect.
Applying the patch immediately might mitigate the risk but could cause unplanned downtime, which may disrupt business operations. Risk management involves balancing security with operational needs, so this approach lacks consideration of business continuity.
- B. Correct.
Evaluating the likelihood and impact of the attack is key to risk management. This allows the company to prioritize the response based on the severity of the risk and the potential consequences.
- C. Correct.
Implementing compensating controls like a web application firewall (WAF) is a valid risk management strategy. It provides temporary protection until the patch can be applied during a controlled maintenance window, minimizing operational disruption.
- D. Incorrect.
Ignoring the vulnerability is not a valid risk management strategy. Risks must be evaluated and addressed to protect the organization from potential harm.