ISC2 Certified in Cybersecurity (CC)Network SecurityHard
A security analyst is investigating a potential data breach where sensitive employee records were exfiltrated from an internal server. The investigation reveals that the attacker gained access through a web application vulnerability and then used this access to move laterally within the network. Which security measure, if properly implemented, would have been most effective in preventing the lateral movement of the attacker to the sensitive data server?
- AImplementing a robust antivirus solution on all workstations.
- BNetwork segmentation between the web application server and the sensitive data server.
- CRegular security awareness training for employees.
- DStronger password policies for user accounts.
Show answer & explanationAnswer & explanation
Correct answer: B. Network segmentation between the web application server and the sensitive data server.
Network segmentation would isolate the web application server from the sensitive data server, making lateral movement significantly harder even after an initial compromise, thereby limiting the blast radius.
Why the other options are wrong
- A. Antivirus primarily protects endpoints from malware; it's less effective against lateral movement originating from a compromised server via application vulnerabilities.
- C. Security awareness training addresses human-related vulnerabilities but wouldn't directly prevent lateral movement after a server-side exploit.
- D. Stronger password policies help prevent credential-based attacks but wouldn't stop lateral movement if the initial breach wasn't credential-related or if other vulnerabilities exist.
Network Segmentation
The practice of dividing a computer network into multiple smaller network segments, each acting as its own small network.
- Reduces the attack surface by isolating critical assets.
- Limits lateral movement of attackers within the network.
- Improves network performance and security posture.
Memory trick: Segment Safely, Passwords Protect, Training Teaches, Antivirus Acts.