A zero-day affects AP OS images on the municipal mesh with no vendor patch yet, but compensating WIPS signatures are available. What mitigation approach fits best?
Select an answer to reveal the explanation.
Short Explanation
No patch yet does not mean nap time. Turn on the WIPS signatures you have, quarantine the juiciest APs, and babysit the municipal mesh until the vendor drops a fix.
Full Explanation
When a zero-day affects AP OS images on the municipal mesh with no vendor patch yet, but compensating WIPS signatures are available, the best mitigation approach is to apply compensating WIPS monitoring and quarantine exposed or high-risk APs pending an upgrade. Compensating controls reduce exploit likelihood and impact while preserving essential service where possible. Doing nothing until a patch ships leaves APs fully exposed without monitoring changes. Publicly posting AP console passwords so citizens can help watch for exploitation increases compromise risk. Disabling all encryption citywide as a temporary workaround for the zero-day worsens confidentiality far beyond the original issue. Municipal zero-day response should combine detection signatures, reduced exposure, and accelerated upgrade planning when the vendor fix arrives. Exam caveat: compensating controls are interim; they do not replace installing the vendor fix when it becomes available. Operational check: deploy the new WIPS signatures, identify highest-risk mesh nodes for quarantine or reduced function, increase logging to the SOC, communicate residual risk to city leadership, and pre-stage the upgrade plan for rapid execution when the patched image ships.