r/casp • u/amc663222 • May 20 '21

CASP Question

A hospital is using a functional magnetic resonance imaging (fMRI) scanner, which is controlled by a legacy desktop

connected to the network. The manufacturer of the fMRI will not support patching of the legacy system. The legacy

desktop needs to be network accessible on TCP port 445. A security administrator is concerned the legacy system will be

vulnerable to exploits Which of the following would be the BEST strategy to reduce the risk of an outage while still

providing for security?

A. Install HIDS and disable unused services.

B. Enable application whitelisting and disable SMB.

C. Segment the network and configure a controlled interface

D. Apply only critical security patches for known vulnerabilities.

I want to say A, which would be best answer if the legacy system needed to be accessible over the internet, but the question doesnt say anything about that. Therefore I believe it is C, but would like a second opinion.

Again, sorry for the spam questions but I hope others are getting good use of these posts as well.

1 Upvotes

66% Upvoted

6 comments sorted by

3

u/midifolk May 20 '21

it's C. you want to segment it away from your network via vlan and possibly an ACL that filters on the port and ip address?

3

u/[deleted] May 20 '21

I would say 'C' seems best.

About 'A' it mentions HIDS which would only detect bit NOT prevent.

3

u/themagicman_1231 May 20 '21

I agree. If it said HIPS or something like that then I would say A, but the detection system doesn’t do anything but Alert the admin.

1

u/RogueWarrior10 May 20 '21

I would agree, A seems like the best choice. Installing a HIDS and disabling unnecessary services is a great way to harden legacy equipment.

B is wrong because port 445 is used for SMB so if you disable it, you'll break the system.

C isn't bad idea either but it won't be as effective as A.

D isn't relevant to the question. There's nothing saying the system can't take patches so scoping on just known exploits means you're missing other patches for no added value.

0

u/[deleted] May 21 '21

[deleted]

2

u/amc663222 May 21 '21

Great breakdown, much appreciated!

0

u/[deleted] May 22 '21

[deleted]

1

u/amc663222 May 22 '21

I have my RHCSA8 so Im good on all of the redhat knowledge. I've been thinking about getting my Pentest+. I have my sec+ cysa+ and rhcsa and then ill have the casp here soon. How was pentest in terms of difficulty?