ISACA Certified Information Systems Auditor (CISA) ExamDomain 5: Protection of Information AssetsMedium
A CISA is reviewing an organization's security architecture following a recent acquisition. The acquired company's infrastructure includes several legacy systems that are critical for business operations but cannot support modern encryption protocols (e.g., TLS 1.2 or higher). The CISA observes that these systems communicate with newer, external partner systems that enforce strong encryption. How should the CISA BEST advise the organization to mitigate the security risks associated with this scenario?
- ADeploy a secure proxy or gateway to mediate communication between systems.
- BMandate an immediate upgrade or replacement of all legacy systems.
- CImplement a network segmentation strategy to isolate the legacy systems.
- DAccept the risk, as the business criticality outweighs the security concerns.
Show answer & explanationAnswer & explanation
Correct answer: A. Deploy a secure proxy or gateway to mediate communication between systems.
A secure proxy or gateway can act as an intermediary, terminating the insecure connection from the legacy system and establishing a secure connection to the external partner. This allows communication to continue while enforcing modern encryption without modifying the legacy system itself.
Why the other options are wrong
- B. Immediate replacement may be impractical due to cost, time, or business disruption, and isn't the 'BEST' immediate mitigation.
- C. Segmentation helps but does not resolve the insecure communication issue when the legacy system *needs* to communicate externally.
- D. Accepting the risk without mitigation is generally not an acceptable audit recommendation, especially when viable technical controls exist.
Encryption Gateway/Proxy
A network device or software that acts as an intermediary, encrypting or decrypting traffic to ensure secure communication between systems with differing encryption capabilities.
- Facilitates secure communication for legacy systems.
- Translates or upgrades encryption protocols.
- Can enforce security policies at the network edge.
Memory trick: Old castles need a secure tunnel to talk to the modern world.