A penetration tester submits a test report recommending remediation for a high-severity finding. The client's development team says the fix will take 6 months to implement. What should the client implement in the meantime?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need compensating controls while the permanent fix is developed. WAF rules, network access restrictions, enhanced monitoring, and input validation reduce exposure to a known vulnerability during the remediation period.
Full Explanation
Implementing compensating controls is correct because compensating controls reduce the risk exposure of a known vulnerability during the remediation period; WAF rules can block specific exploit patterns, network controls can limit who can reach the vulnerable service, enhanced monitoring provides early warning of exploitation attempts, and input validation can reduce the chance of successful exploitation. Formally accepting the risk and implementing no compensating controls until the fix is ready is wrong because accepting risk without compensating controls is appropriate only after evaluating and implementing all practical risk reduction options. Removing the affected system from service until the fix is complete is wrong because removing the system from service may not be feasible if it supports business operations; compensating controls allow continued operation with reduced risk. Changing the risk rating to low so stakeholders are not alarmed during the remediation period is wrong because changing risk ratings to avoid alarming stakeholders is dishonest risk management and prevents informed business decisions.