An enterprise security architect is updating host and network hardening standards across the organization to address findings from a recent security assessment. Match each enterprise security risk scenario on the left with the most effective enterprise hardening mitigation on the right.
- Unauthenticated rogue hardware devices connecting directly to open Ethernet wall jacks in physical common areasImplement 802.1X Network Access Control (NAC) with dynamic VLAN assignment on switch ports
- Kernel-level rootkits modifying boot loader components prior to operating system initializationEnable UEFI Secure Boot paired with Trusted Platform Module (TPM) Measured Boot
- Compromised background daemon processes leveraging inherited root privileges to alter host system filesEnforce daemon process sandboxing and dedicated service accounts following least privilege
- Cleartext directory service queries on internal subnets exposing user authentication tokens to packet sniffingEnforce mandatory LDAP Signing and LDAPS (LDAP over TLS) via group policy
Answer
The enterprise security risk scenarios map directly to their corresponding technical mitigations: physical port access is secured by 802.1X NAC; system boot integrity is guaranteed by UEFI Secure Boot and TPM; daemon privilege escalation is mitigated by process sandboxing and least privilege; and unencrypted directory traffic is secured using LDAPS and LDAP signing.
Each hardening technique directly neutralizes the specified threat vector: 802.1X prevents unauthorized physical switch port connections; UEFI Secure Boot verifies pre-OS bootloader integrity; process sandboxing limits daemon privilege abuse; and LDAPS secures directory session traffic against passive eavesdropping.
Step-by-Step Solution
Key Concept
Enterprise Hardening and Security Mitigation Controls