4. A systems administrator configures a new application. The next day a security analyst reviews the logs and identifies multiple accounts that had been created overnight with administrative privileges and connections from different countries. Which of the following solutions would have prevented this incident?
Answer: B
Changing the default credentials would have prevented this incident.
Implementing strong, unique credentials is crucial for preventing unauthorized access. By changing the default credentials, the systems administrator would have reduced the risk of attackers exploiting weak or easily guessable login information.
A) Applying input validation
While applying input validation is essential for preventing injection attacks and ensuring data integrity, it does not directly address the issue of unauthorized account creation or administrative access. Therefore, this option does not relate to the specific incident described.
B) Changing the default credentials
Changing the default credentials directly addresses the vulnerability that allows attackers to exploit weak passwords associated with newly configured applications. By ensuring that default credentials are modified, the risk of unauthorized administrative account creation from various locations would have been significantly mitigated.
C) Installing a honeynet
A honeynet is a network of decoy systems designed to lure attackers and study their behavior. However, it does not prevent unauthorized activity; instead, it serves as a detection mechanism. As such, it would not have stopped the incident from occurring in the first place.
D) Deploying a WAF
A Web Application Firewall (WAF) is effective in protecting web applications from various attacks, such as cross-site scripting or SQL injection. However, it does not specifically prevent unauthorized account creation or administrative access issues, making it an inadequate solution for this particular scenario.
Conclusion
Changing the default credentials is a fundamental security measure that directly addresses the root cause of the unauthorized administrative account creation in this incident. All other options, while important in their own contexts, do not effectively prevent the specific threat of unauthorized access associated with default credentials.