The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released. Which of the following would best protect this organization?
The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released. Which of the following would best protect this organization?
A mean time to remediate of 30 days is the best option to protect the organization. This means that the organization aims to fix vulnerabilities within 30 days of their discovery. Given that the exploitation of new attacks occurs approximately 45 days after a patch is released, having a remediation period shorter than 45 days ensures that vulnerabilities are patched before they can be exploited.
I think they trying to trick you... I am looking at the key words Response vs Remediation. Response - Incident response activities include detection, analysis, containment, eradication, recovery, communication, and documentation. Remediation - Remediation activities include applying patches, fixing misconfigurations, updating security policies, improving access controls, and implementing other corrective measures.
And we can also Calculate mean time to respond by measuring the time from when your team detects an incident to when you launch (or complete) the repair or remediation plan. So answer is A
I think that it wouldn't be "A" because they didn't mention this vuln existed in their environment. They just mentioned that the CEO heard, so this mean that they need to do some of the activities to identify whether vuln finding has existed on their environment or not! Please help to correct me, if I am wrong!
Not sure if A or C. I'm leaning more to A. The term 'mean time to remediate' is a definition - at least in comptia study guide! It is used in the IR metrics chapter. So we have it in this order: mean time to detect mean time to respond mean time to remediate I would say "mean time to respond" does not include patching, but in it is in the "mean time to remediate", so that is why I choose A.
A mean time to remediate of 30 days implies that the organization aims to remediate vulnerabilities within 30 days of their discovery. Since exploitation of new attacks tends to occur approximately 45 days after a patch is released, aiming for a mean time to remediate of 30 days ensures that vulnerabilities are patched before attackers have the opportunity to exploit them.
To best protect the organization from exploitation of new attacks, it's important to reduce the time between the release of patches and their implementation within the organization. This is known as the "time to remediate" or "mean time to remediate" (MTTR). Therefore, the option that aligns with this objective is: A. A mean time to remediate of 30 days A shorter mean time to remediate ensures that patches are applied more quickly, reducing the window of vulnerability and the likelihood of exploitation. Options B and C, with longer timeframes, would increase the organization's exposure to potential attacks. Third-party application testing (option D) is important but is not directly addressing the time it takes to apply patches after they are released.
Scored around 820. Went with A
Mean time to respond has got more to do with security incidents. A patch needs to be applied, a system needs to be remediated, not responded to.
A is correct. MTTR involves the entire process, detection is only part .
It is A. There is no such phrase in security as 'mean time to remediate'. MTTR = mean time to respond, and it includes remediation implicitly.
For this very reason. If there is no "mean time to remediate", the correct answer is C.
There is such a phrase in Security as "mean Time to Remediate". Look it up!
A. is the only answer that specifies a timeframe for "remediation." That is the keyword in this answer. 30 days is also less than the defined maximum in the question.
I think that it wouldn't be "A" because they didn't mention this vuln existed in their environment. They just mentioned that the CEO heard, so this mean that they need to do some of the activities to identify whether vuln finding has existed on their environment or not! Please help to correct me, if I am wrong!
the answer is A. Remediation because the patch is already there. Responding takes place when the patch is not there.Mean time to respond (MTTR) is the average time it takes DevOps teams to respond after receiving an alert. Teams often use this metric to measure the time between when they detect an incident and when they mount a remediation plan. Many teams include the time it takes to repair or remediate the issue in this metric. This does not include lag time in the alert system.
We can Calculate MTTR by measuring the time from when your team detects an incident to when you launch (or complete) the repair or remediation plan.
And we can also Calculate mean time to respond by measuring the time from when your team detects an incident to when you launch (or complete) the repair or remediation plan. So answer is A
I think the more viable answer is Mean Time to Remediate. Remediation incorporates the response and determines the average time it is resolved by. Response does not determine when the issue is remediated, simple that it is being responded to. Since Remediation incorporates response and is below the 45 day window of exploitations this seems like the best answer that takes away all guesswork.
C is correct. When you have a response policy that requires a review at least every 15 days, it will help the company recognize all newly patched exploitations within that timeframe, as a mean time to respond (MTTR) of 15 days is required. When you discover a risk, your team will fix it right away with just a click of a button to update the patch released 15 days ago. The goal is to find out about it ASAP. It is nonsensical to compare mean time to remediate or respond in this context. Are you going to sit there after you have responded to it and watch because no-one told you to remediate it, or act honorably, honestly, justly, and responsibly by fixing the issue as soon as possible with your professional responsibility?
Guys this is C 100%, this question is eluding to the fact that the company are taking too long to patch vulnerable systems. A mean time to respond of 15 days is much better & faster than a mean time to remediate of 30 days.
Mean time to respond of 15 days Faster reaction to threats Somewhat relevant - but patching speed remains crucial. Therefore answer should be A
What is MTTR - Mean Time to Respond/Remediate? MTTR is the amount of time it takes an organization to neutralize an identified threat or failure within their network environment. Threat remediation is the process organizations use to identify and resolve threats to their network environment.
Mean time to respond refers to the average time it takes an organization to respond to a security incident after it has been detected. A shorter mean time to respond is generally associated with more effective incident response and containment.