After a merger between two companies a security analyst has been asked to ensure that the organization's systems are secured against infiltration by any former employees that were terminated during the transition.
Which of the following actions are MOST appropriate to harden applications against infiltration by former employees? (Choose two.)
Click on the arrows to vote for the correct answer
A. B. C. D. E. F.CF.
The situation requires the security analyst to implement measures that harden the organization's systems against infiltration by former employees who were terminated during the merger transition. This means that the terminated employees may still have access to the organization's systems, and as such, the security analyst must take steps to mitigate this risk.
The two most appropriate actions to take to harden applications against infiltration by former employees are:
Develop and implement updated access control policies: The security analyst should review and update the organization's access control policies to ensure that only authorized personnel have access to the organization's systems. This could include creating new user accounts, disabling or deleting inactive accounts, revoking access privileges, and restricting access to sensitive data or systems based on job roles or responsibilities. By implementing an access control policy, the organization can limit the chances of former employees gaining unauthorized access to its systems.
Assess and eliminate inactive accounts: As part of the access control policy, the security analyst should assess all user accounts to identify inactive accounts that may be vulnerable to infiltration by former employees. These accounts should be either deleted or disabled to prevent unauthorized access to the organization's systems. Additionally, the security analyst should review the access logs to identify any suspicious login attempts or activities and address them promptly.
The other options listed, while they may be important security measures to implement, are not directly relevant to the situation described. For example:
Monitoring VPN client access (Option A) is important for preventing unauthorized access from remote locations but may not be specifically related to former employees.
Reducing failed login out settings (Option B) may help mitigate the risk of brute-force attacks but does not specifically address the risk of infiltration by former employees.
Reviewing and addressing invalid login attempts (Option D) may help identify potential security breaches but does not directly address the risk of infiltration by former employees.
Increasing password complexity requirements (Option E) may improve overall security, but it does not directly address the risk of infiltration by former employees.
Therefore, options C and F are the most appropriate actions to harden applications against infiltration by former employees.