10. A systems administrator configures a new application. The next day, a security analyst reviews the logs and identifies multiple accounts that had been created overnight with administrative privileges and connections from different countries. Which of the following solutions would have prevented this incident?
Answer: B
Changing the default credentials would have prevented this incident.
By changing the default credentials, the systems administrator could have significantly reduced the risk of unauthorized account creation and access, as many automated attacks exploit default usernames and passwords.
A) Applying input validation
While applying input validation is a crucial security measure to ensure that only valid data is processed by the application, it primarily protects against issues such as injection attacks and does not directly address the risk of unauthorized account creation or access with administrative privileges.
B) Changing the default credentials
Changing the default credentials is highly effective in preventing unauthorized access. Many attackers exploit default usernames and passwords to gain administrative privileges. By ensuring that these credentials are changed, the likelihood of unauthorized account creation and access from various locations is significantly diminished.
C) Installing a honeynet
Installing a honeynet could help in detecting and analyzing potential attacks by simulating vulnerable systems to attract malicious actors. However, it would not prevent unauthorized account creation; rather, it would only serve as a monitoring tool after the fact.
D) Deploying a WAF
Deploying a Web Application Firewall (WAF) is beneficial for protecting applications from attacks such as SQL injection and cross-site scripting. However, a WAF does not specifically prevent unauthorized account creation or the use of default credentials, which is central to this incident.
Conclusion
Changing the default credentials is the most effective preventive measure in this scenario, as it directly addresses the vulnerability exploited by attackers to create unauthorized accounts with administrative privileges. Other options, while useful for different aspects of security, do not specifically mitigate the risk associated with weak or unchanged default credentials.