A security team is reviewing the results of a vulnerability scan on a critical production server. The scan report indicates a 'High' severity vulnerability related to an outdated version of SSH. Due to operational constraints, immediate patching is not possible. What is the most appropriate temporary mitigation strategy to reduce the risk associated with this finding?
- AAccept the risk and schedule patching for the next maintenance window.
- BImplement IP-based access restrictions to the SSH service.
- CDowngrade SSH to an older, less vulnerable version.
- DDisable the SSH service on the server immediately.
Show answer & explanationAnswer & explanation
Correct answer: B. Implement IP-based access restrictions to the SSH service.
Disabling SSH (A) might disrupt critical operations. Accepting the risk (C) without mitigation is generally not advisable for a 'High' severity vulnerability. Downgrading SSH (D) could introduce new vulnerabilities or instabilities. Implementing IP-based access restrictions (B) is a common and effective temporary control to significantly reduce the attack surface for a network-accessible service when immediate patching is not feasible. It limits who can even attempt to exploit the vulnerability.
Why the other options are wrong
- A. Accepting a 'High' risk without any mitigation is generally considered irresponsible in cybersecurity.
- C. Downgrading software can introduce new vulnerabilities or system instability and is rarely a recommended mitigation strategy.
- D. Disabling SSH could impact critical administrative functions and is often not a feasible temporary solution.
Temporary Mitigation
Actions taken to reduce the immediate risk of a vulnerability when full remediation is not immediately possible. These measures are often less comprehensive but provide interim protection.
- Used when patching or full remediation is delayed.
- Aims to reduce exploitability or impact.
- Examples include network segmentation, access restrictions, or disabling services.
Memory trick: Mitigation builds a temporary wall when the main gate is broken.