712-50 Question 309
Single answerVirus, Trojans and Malware, and other Malicious Code Threats (6 questions)A global manufacturing company discovers that several engineering workstations have been infected with malware introduced through a supplier-shared design file. The malware evaded signature-based antivirus, established persistence, and began attempting lateral movement toward systems connected to production management. The board asks the CISO for the most effective strategic action to reduce the likelihood and business impact of similar malicious code incidents in the future, without unduly disrupting supplier collaboration. Which action should the CISO prioritize?
- A
Mandate daily full-disk antivirus scans on all engineering workstations and increase malware signature update frequency
- B
Implement application allowlisting, network segmentation between engineering and production environments, and sandbox analysis for externally received files
- C
Prohibit all external file sharing with suppliers and require hard-copy design exchange until the threat landscape stabilizes
- D
Rely on user awareness training as the primary control, since malware entered through a user opening a supplier file
Show answer and explanation
Correct answer: B
Explanation
The strongest CCISO-level response is to prioritize a defense-in-depth strategy that reduces both the probability of malware execution and the potential business impact if execution occurs. In this scenario, the key facts are that the malware came through an external file, bypassed signature-based antivirus, established persistence, and attempted lateral movement toward production-related systems. This means the organization needs controls that address unknown malware, execution control, and segmentation.
Application allowlisting is a strong preventive measure recommended in multiple security frameworks because it restricts unauthorized code execution. Network segmentation is a foundational architectural control that limits propagation and protects high-value or operationally sensitive environments. Sandboxing or detonation of externally received files adds a behavioral analysis layer for suspicious attachments and shared content, which is particularly useful against novel malware and trojans.
This approach is consistent with widely accepted guidance such as NIST SP 800-83 on malware incident prevention and handling, NIST Cybersecurity Framework practices around protective technology and detection, and CIS Controls covering malware defenses, application control, secure configuration, and network segmentation. From a CCISO perspective, the answer reflects appropriate executive prioritization: implement sustainable, risk-based controls that support business operations while materially improving resilience against viruses, trojans, malware, and other malicious code threats.
- A. Incorrect.
This is an incomplete and less effective response. Increasing scan frequency and signature updates may help detect known malware, but the scenario explicitly states the malware evaded signature-based antivirus. Advanced malicious code often uses obfuscation, polymorphism, or zero-day techniques that reduce the effectiveness of signature-only controls. A CISO should prioritize layered preventive and containment controls rather than doubling down on a control class that has already proven insufficient.
- B. Correct.
This is the best answer because it combines prevention, detection, and containment in a way that aligns with real-world malware defense strategy. Application allowlisting reduces execution of unauthorized binaries and scripts. Network segmentation limits lateral movement from engineering systems into production-related environments, reducing operational risk. Sandboxing externally received files helps detect malicious behavior before files reach users. Together, these controls address the specific attack path in the scenario while preserving supplier collaboration through controlled file handling rather than banning it outright.
- C. Incorrect.
This is not the best strategic choice. While blocking all supplier file sharing could reduce one infection vector, it is operationally impractical for a global manufacturing company dependent on design collaboration. CCISO-level decision-making requires balancing security with business enablement. A complete prohibition is typically disproportionate unless there is an immediate emergency containment need, and even then it would be a temporary measure rather than the most effective long-term strategy.
- D. Incorrect.
This is incorrect because user awareness is valuable but insufficient as the primary control against modern malicious code. Users can still be deceived by well-crafted files, and technical controls are needed to prevent execution, detect malicious behavior, and contain spread. Choosing training alone reflects a common misconception that malware incidents are mainly a user failure rather than a layered defense issue involving architecture, endpoint control, and monitoring.