Certified Information Security Manager (CISM)Information Security Risk ManagementMedium
During a security audit, it is discovered that several critical vulnerabilities exist in an organization's internal applications. The development team argues that patching these vulnerabilities would disrupt current project timelines and require significant refactoring. What is the CISO's MOST appropriate immediate action?
- AOrder the development team to immediately stop all other work and fix the vulnerabilities.
- BAccept the risk of the vulnerabilities and document them for future consideration.
- CTransfer the risk by purchasing additional cybersecurity insurance coverage.
- DImplement compensating controls (e.g., WAF, network segmentation) to reduce immediate exposure.
Show answer & explanationAnswer & explanation
Correct answer: D. Implement compensating controls (e.g., WAF, network segmentation) to reduce immediate exposure.
When direct remediation (patching) is immediately disruptive, the most appropriate immediate action is to implement compensating controls. These controls can temporarily reduce the exposure or impact of the vulnerabilities without requiring direct modification to the application, buying time for a more planned remediation.
Why the other options are wrong
- A. This is an extreme measure that could halt business operations and may not be the most strategic first step.
- B. Accepting critical vulnerabilities without any immediate action is irresponsible and increases risk exposure.
- C. Insurance transfers financial risk but does not reduce the operational risk or exposure to an attack, and is not an immediate technical control.
Compensating Controls
Compensating controls are alternative security measures put in place to satisfy the requirements of a security control that cannot be fully implemented due to technical or business constraints.
- Provides an equivalent level of protection.
- Often temporary until primary control can be implemented.
- Examples: WAF, network segmentation, strict access policies.
Memory trick: When you can't fix the hole directly, you put a barrier around it.