Examkin

Soru

Zorluk: OrtaMitigation Strategies and Enterprise Hardening Practices

A manufacturing company relies on legacy operational technology (OT) workstations to manage assembly line machinery. Because these systems run specialized software on an outdated operating system that cannot receive vendor security updates, the security team must harden the workstations without disrupting continuous operations. The primary requirement is to block unauthorized executable files and unapproved dynamic-link libraries (DLLs) from running on the systems. Which of the following host hardening strategies is MOST effective for this requirement?

  1. Implementation of application allowlisting policiesCevap
  2. B
    Deployment of a perimeter stateful inspection firewall
  3. C
    Placement of an interactive deception honeypot on the OT subnet
  4. D
    Execution of weekly automated credentialed network vulnerability scans

Cevap

Implementation of application allowlisting policies is the most effective host hardening strategy.
Application allowlisting (also known as application whitelisting) enforces an explicit default-deny rule on host OS processes. Only pre-approved binaries, scripts, and libraries (DLLs) specified by hash, path, or digital signature are permitted to execute. This makes it ideal for static legacy operational technology environments where OS patching is impossible.

Adım Adım Çözüm

1
Analyze the scenario constraints and requirements.
The target legacy OT systems cannot be patched, run fixed single-purpose software, and require strict prevention of unauthorized binary execution.
Hardening unpatchable legacy hosts requires restrictive execution controls rather than relying on patch management or perimeter filters.
2
Evaluate candidate host-hardening controls against binary execution restriction.
Application allowlisting enforces a strict default-deny policy for any executable, script, or library file not explicitly approved by file path, publisher certificate, or cryptographic hash.
Default-deny application control is optimal for static-function systems like HMIs and OT controllers.
3
Compare against network-level and detective controls.
Firewalls, honeypots, and vulnerability scanners fail to stop localized file execution on the endpoint.
Endpoint security controls are necessary to enforce execution protection on host systems.

Anahtar Kavram

Host Application Hardening and Allowlisting
Bu soruyu puanla

Konular

Mitigation Strategies and Enterprise Hardening Practices

Bu konudan daha fazla soru