A security engineer at a financial institution is reviewing a post-incident report for a critical web application server that was compromised. The investigation revealed that during an off-hours emergency software update, a vendor-supplied deployment script overwritten local system security parameters, reverting the server to an unhardened default baseline. Although the application vulnerability itself was successfully patched, administrative services were inadvertently exposed to the public network. Which of the following operational controls would best prevent this type of configuration drift during future patch deployments?
- Enforce continuous automated configuration management using declarative policy manifests to validate and remediate host state post-deployment.Cevap
- BDeploy host-based web application firewall rules to block exploit traffic directed toward administrative service ports.
- CImplement a passive network intrusion detection system to categorize baseline changes as detective security controls.
- DIncrease the frequency of automated credentialed vulnerability scans executed prior to applying software update packages.
Cevap
Enforcing continuous automated configuration management using declarative policy manifests to validate and remediate host state post-deployment is the correct action.
Automated configuration management tools operating with declarative state definitions continuously audit managed endpoints against designated security baselines. If a patch deployment script alters configuration parameters, the configuration management agent detects the variance (drift) and automatically enforces the mandated secure baseline.
Adım Adım Çözüm
Anahtar Kavram
Configuration Baseline Enforcement and Drift Detection