What action is recommended for any required services, protocols, or daemons that are insecure?

What action is recommended for any required services, protocols, or daemons that are insecure?

• A. Do not configure additional security features for insecure services
• B. Implement additional security features for any required services, protocols, or daemons considered insecure
• C. Remove all insecure services the moment they appear in logs
• D. Ignore the risk of insecure services

Answer: (B)

When a required service, protocol, or daemon is insecure, you don’t abandon it or ignore the risk. The proper approach is to add compensating controls to reduce the risk so the service can remain in use without exposing the environment to heightened threats. This means implementing additional security features and safeguards around that service, such as enabling strong encryption for communications (for example, TLS with up-to-date ciphers), enforcing strong authentication, applying the latest patches and secure configurations, disabling deprecated options, restricting access with firewalls and precise access controls, and enhancing monitoring and logging. You may also segment the network to limit exposure and implement controls like rate limiting or intrusion detection where appropriate. The goal is to bring the overall risk to an acceptable level while still meeting operational needs. Removing or ignoring insecure services would either disrupt operations or leave the system vulnerable, which is not acceptable.

When a required service, protocol, or daemon is insecure, you don’t abandon it or ignore the risk. The proper approach is to add compensating controls to reduce the risk so the service can remain in use without exposing the environment to heightened threats. This means implementing additional security features and safeguards around that service, such as enabling strong encryption for communications (for example, TLS with up-to-date ciphers), enforcing strong authentication, applying the latest patches and secure configurations, disabling deprecated options, restricting access with firewalls and precise access controls, and enhancing monitoring and logging. You may also segment the network to limit exposure and implement controls like rate limiting or intrusion detection where appropriate. The goal is to bring the overall risk to an acceptable level while still meeting operational needs. Removing or ignoring insecure services would either disrupt operations or leave the system vulnerable, which is not acceptable.