CRISC Certified in Risk and Information Systems ControlInformation Technology and SecurityMedium
An organization is deploying a new cloud-based application that processes sensitive customer data. The Chief Information Security Officer (CISO) is concerned about the potential for data breaches due to misconfigurations or vulnerabilities in the cloud environment. To address this, the CISO mandates a review process that ensures all cloud security configurations adhere to established benchmarks (e.g., CIS Benchmarks) and that infrastructure-as-code templates are scanned for security flaws before deployment. Which security concept is the CISO primarily emphasizing?
- AContinuous Monitoring
- BAttack Surface Management
- CSecurity by Obscurity
- DDefense in Depth
Show answer & explanationAnswer & explanation
Correct answer: B. Attack Surface Management
The CISO's actions, by focusing on adhering to benchmarks and scanning infrastructure-as-code for flaws, are directly aimed at identifying and reducing the potential points of attack (the attack surface) in the cloud environment.
Why the other options are wrong
- A. Continuous monitoring is about ongoing surveillance, but the scenario emphasizes proactive measures to reduce potential vulnerabilities before deployment, which is more aligned with attack surface reduction.
- C. Security by obscurity relies on hiding vulnerabilities rather than fixing them, which is generally not an effective or recommended strategy.
- D. Defense in depth involves multiple layers of security controls, but the scenario specifically details actions to reduce the entry points, which is attack surface management.
Attack Surface Management
The continuous process of discovering, classifying, prioritizing, and remediating vulnerabilities and potential entry points that an attacker could exploit to gain unauthorized access or disrupt systems.
- Aims to reduce the number of potential attack vectors.
- Involves identifying all accessible assets and their vulnerabilities.
- Proactive approach to security.
Memory trick: To 'Attack' fewer 'Surfaces', 'Trim' the 'Edges'.