After conducting vulnerability scanning, your security team reports an urgent and critical operating system vulnerability. Which of the following is the best action the IT operations team should take? (Wentz QOTD)
A. Follow the standard change procedure to apply the patch immediately.
B. Apply the patch after a normal change request has been approved.
C. Apply the patch immediately, then submit an aftermath change request.
D. Submit a change request with priority for acceleration, but apply the patch after approval.
Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.
My suggested answer is D. Submit a change request with priority for acceleration, but apply the patch after approval.
Wentz’s book, The Effective CISSP: Security and Risk Management, helps CISSP and CISM aspirants build a solid conceptual security model. It is a tutorial for information security and a supplement to the official study guides for the CISSP and CISM exams and an informative reference for security professionals.
Reference
在進行漏洞掃描後，您的安全團隊報告了一個緊急且嚴重的操作系統漏洞。 以下哪項是 IT 運營團隊應該採取的最佳行動？(Wentz QOTD)
A. 按照標準變更程序立即打上補丁。
B. 在正常變更請求被批准後再打上補丁。
C. 立即打上補丁再提交後補變更請求。
D. 提交高優先權的變更請求來加速審核流程，但審核通過後才打上補丁。