A security technician reviews a vulnerability scanner report for an unpatchable host operating critical legacy services:
`[WARN] Host 10.0.4.15 (Legacy_SCADA_GW): Outdated SSLv3 enabled on port 443`
`[WARN] Host 10.0.4.15 (Legacy_SCADA_GW): Active unencrypted Telnet service detected on port 23`
`[INFO] Host 10.0.4.15 shares a flat Layer 2 broadcast domain with 150 user workstations.`
Because replacing or patching the legacy system would interrupt critical operations, which of the following is the MOST effective architectural control to mitigate network-based exploitation of these host vulnerabilities?
- Implement microsegmentation to place the legacy host in an isolated VLAN with restricted jump box access controls.Answer
- BInstall an endpoint detection and response (EDR) agent on the host to terminate unencrypted Telnet sessions in real time.
- CConfigure the primary enterprise perimeter firewall to block inbound external traffic destined for TCP ports 23 and 443.
- DDeploy a passive network intrusion detection system (NIDS) on the local switch port to monitor broadcast traffic.
Answer
Implementing microsegmentation and isolating the host within a restricted VLAN via a secure jump box is the most effective architectural mitigation.
Microsegmentation compensates for unpatchable host vulnerabilities by placing the vulnerable device in an isolated VLAN and restricting network access strictly to authenticated administrative jump hosts. This prevents lateral attack traffic within the internal broadcast domain.
Step-by-Step Solution
Key Concept
Compensating Controls for Legacy Infrastructure Vulnerabilities