English
Menu

Cyber Attacks and Defense in Practice

In the same week, fixes were released for three vulnerabilities. The operations staff can apply only one fix per day. Which of the following is the most appropriate combination of the fix to apply first and the reason?

  1. AA vulnerability in a business server used only on a closed internal network (CVSS base score 9.8, no reports of exploitation), because it has the highest base score
  2. BA vulnerability in the image viewer used on employees' PCs (CVSS base score 5.5), because it is installed on the largest number of devices
  3. CA vulnerability in a VPN appliance exposed to the internet (CVSS base score 8.1, exploitation in the wild confirmed), because it is reachable from outside and already used in attacks
Show answer and explanation

Answer: C. A vulnerability in a VPN appliance exposed to the internet (CVSS base score 8.1, exploitation in the wild confirmed), because it is reachable from outside and already used in attacks

The CVSS base score expresses the severity of a vulnerability itself and does not express how likely attacks are in the organization's own environment. A vulnerability in a device reachable directly from the internet whose exploitation in real attacks has been confirmed is likely to be targeted soon, so it takes priority even though its base score of 8.1 is lower than 9.8. The exploitation status can be checked in the catalog of vulnerabilities confirmed as exploited (KEV: Known Exploited Vulnerabilities) published by the US CISA since November 2021, and in alerts from vendors and JPCERT/CC. The vulnerability in the internal-only server is also serious, so it is handled right after the VPN appliance, with risk reduced in the meantime by measures such as restricting traffic.

  • A. Its base score is high, but it is not directly reachable from outside and there are no reports of exploitation, so it can come after the one that is exposed and being exploited.
  • B. It is installed on many devices but its severity is moderate, so it is not the one to handle first.
  • C. Correct. Being reachable from outside and actually being exploited together make the risk the greatest.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. Which of the following correctly describes the differences between vulnerability scanning, penetration testing and red team exercises as ways of checking an organization's defenses?
  2. An outside security researcher has found an undisclosed vulnerability in a company's product. Which of the following is the most appropriate way to proceed according to the idea of coordinated vulnerability disclosure?
  3. Which of the following is the main purpose of creating and maintaining an SBOM (software bill of materials)?
  4. A company uses an internal-only library named acme-utils, kept in its internal package repository (private registry). An attacker registered a package with the same name, acme-utils, and a higher version number in a public package repository, and it turned out that, depending on the build settings, the internal build environment could pull in the attacker's package. Which of the following is the most appropriate countermeasure to this "dependency confusion"?
  5. In the SolarWinds incident discovered in December 2020, attackers got into the build environment of IT management software and malicious code was mixed into legitimate updates. The updates were distributed carrying the developer's legitimate code signature. Which of the following is the most appropriate lesson from this incident?

Comparisons in this topic