A scan reveals a critical remotely exploitable flaw in a building management appliance that must stay in service. The vendor states that a patch will not be available for several months. Which action BEST reduces exposure now?
Select an answer to reveal the explanation.
Short Explanation
No patch? You still have options - put the box in its own little room and lock the doors. Segmentation plus compensating controls cuts down who can even reach that flaw. The trap is insurance or acceptance: they change who pays, not how exposed you are.
Full Explanation
When a patch is unavailable, remediation shifts to reducing the likelihood that the flaw can be reached and exploited. Placing the appliance in a restricted network segment, permitting only the specific management hosts and protocols it needs, removes most attack paths. Compensating controls such as access control lists, intrusion prevention signatures for the flaw, disabling the vulnerable service if the function allows, and heightened monitoring of the segment further limit exposure while the device keeps running. Formally accepting the risk and doing nothing else leaves a critical, remotely exploitable flaw fully reachable, which contradicts the requirement to reduce exposure now. Cyber insurance is risk transfer; it may offset financial loss after an incident, but it does nothing to prevent exploitation. Decommissioning the device would remove the exposure, yet the scenario states the appliance must stay in service, so it fails the stated constraint. Exam caveat: compensating controls are temporary and should carry an exception with an expiration date tied to the vendor's patch timeline. Operational check: from a general user subnet, attempt to reach the vulnerable service and confirm it is blocked, then confirm the exception is tracked in the risk register for review.