A zero-day vulnerability with no available patch is publicly announced for a widely used file-transfer product. What should the information security manager do FIRST?
Select an answer to reveal the explanation.
Short Explanation
Before you sound the fire alarm, find out whether that brand of toaster is even in your kitchen. Your asset inventory tells you if you're exposed and where. The trap is jumping to customer notices, shutdowns or forensics before you know the product's actually there.
Full Explanation
Every response to a newly announced vulnerability starts with exposure: is the affected product in the environment, which versions, on which systems, supporting which business processes and exposed to which networks. An accurate asset and software inventory answers those questions quickly and lets the security manager prioritize mitigation such as restricting exposure, applying vendor workarounds and increasing monitoring on the systems that matter. Notifying customers of possible exposure before knowing whether the product is used, let alone compromised, is premature, may be inaccurate and can cause unnecessary harm and legal consequences. Disabling the product everywhere may be justified later for critical, exposed instances, but doing it blindly first can halt business processes the product supports, and it cannot be targeted without knowing where the product runs. Engaging forensic support assumes an incident that has not been identified; forensic analysis follows indicators of compromise, not an advisory. Exam caveat: once exposure is confirmed, checking for signs of exploitation becomes urgent, and incident procedures apply if any are found. Operational check: confirm the inventory query results list every instance, its owner and its exposure, and that each instance has an assigned mitigation action and deadline.