An architecture review finds that all internet traffic passes through one security inspection appliance, and its failure would halt customer transactions. What should the information security manager recommend?
Select an answer to reveal the explanation.
Short Explanation
A bridge with one support pillar is fine until the day it isn't. Your security controls can be single points of failure too, and when they fall over the business stops. The trap is solving availability by weakening security, or assuming a support contract is the same as resilience.
Full Explanation
Security architecture must protect availability as well as confidentiality and integrity, so a control that can stop the business is itself a risk to be treated. The appropriate response is to design redundancy, such as clustered or paired components with tested failover, sized to the availability requirements established for the customer transaction service. That preserves inspection while removing the single point of failure. Bypassing inspection under high load is a fail-open approach that removes protection exactly when traffic peaks, which is when attacks such as floods are most likely to be present; it trades one risk for another without the risk owner's decision. Removing the appliance eliminates the outage risk by eliminating the control, leaving the threats it addressed untreated and probably exceeding risk appetite. Relying on a vendor support contract does not prevent the outage; it only shortens repair time after the business has already stopped, and accepting the risk is a decision for the business owner rather than an engineering default. Exam caveat: if business requirements show a short outage is tolerable, a lower-cost option may be justified, so the design should follow the stated availability needs. Operational check: confirm failover is tested on a schedule and that recovery time meets the documented requirement.