CSC2 emphasizes proactive security controls. Hard-coded credentials, regardless of the service’s criticality, violate fundamental security principles (like CSC 16: Account Monitoring and Control). The immediate priority is to eliminate the exposed secret by rotating the credential and implementing a secure, automated solution (like a secrets manager) to prevent recurrence, aligning with secure development and deployment practices.

CSC 13: Data Protection mandates protecting sensitive information based on its classification. Storing data classified as ‘Internal’ (which implies some sensitivity) on a share with excessive access permissions (all authenticated users) is a failure to enforce data protection through access controls. The control calls for processes like data categorization and access control lists, which are not properly implemented here.

This scenario tests the application of multiple CSC2 controls. CSC 12: Controlled Use of Administrative Privileges explicitly calls for changing default passwords and using dedicated admin accounts. CSC 9: Limitation and Control of Network Ports requires minimizing the attack surface. The correct action implements these specific, practical controls without unnecessarily rejecting a potentially useful product, demonstrating risk mitigation.

CSC2 is organized by order of effectiveness. While all are important, CSC 7: Email and Web Browser Protections is specifically designed to mitigate threats delivered via these common vectors. It includes controls for email attachment filtering, URL categorization, and browser protection, which directly address the root cause of the described incident. This aligns with the ‘offense must inform defense’ philosophy by blocking attacks at the initial point of entry.

CSC 12 emphasizes protecting administrative accounts, and CSC 2 calls for inventorying software. When a vulnerable system cannot be patched (a failure of CSC 4: Continuous Vulnerability Assessment and Remediation), CSC 9: Limitation and Control of Network Ports and the concept of segmentation (implied in multiple controls) become critical compensating controls. Containing the potential blast radius by limiting the account’s network reach is a practical, defensive measure.

CSC 6: Maintenance, Monitoring, and Analysis of Audit Logs directly addresses this scenario. It mandates collecting adequate logs to answer the ‘who, what, when, where, and how’ for events, not just failures. Comprehensive logs (including successful authentications, key transactions, etc.) are essential for detecting sophisticated attacks, conducting forensics, and understanding normal vs. anomalous behavior, which outweighs the minor concern of storage space.

You cannot secure what you don’t know about. CSC 2: Inventory of Authorized and Unauthorized Software is a foundational critical control. The first step must be to bring the asset under management by adding it to the inventory. This then enables the application of other controls: assessing its configuration (CSC 3, CSC 5), applying data protection (CSC 13), and managing accounts (CSC 12, 16). Starting with a technical control like MFA (while good) skips the essential administrative control of inventory and governance.

While traditional antivirus (part of CSC 8) is important, this question tests deeper knowledge of the sub-controls within CSC 8: Malware Defenses. It explicitly recommends tools that can detect and block attacks using behavioral analysis or machine learning, which are necessary to counter techniques like fileless malware that evade signature-based detection. Strengthening CSC 8 with advanced endpoint detection and response (EDR) capabilities is the direct and appropriate response.

This tests the practical application of CSC 12 and CSC 13 in a modern context. The containerization approach aligns with the principle of least privilege and data protection. It secures corporate data (allowing for encryption, remote wipe of the container, and enforcing access controls) while respecting the privacy and ownership of the personal device. It balances the business need for flexibility with the security need for control over corporate assets.

CSC2 emphasizes proactive security controls. Hard-coded credentials, regardless of the service’s criticality, violate fundamental security principles (like CSC 16: Account Monitoring and Control). The immediate priority is to eliminate the exposed secret by rotating the credential and implementing a secure, automated solution (like a secrets manager) to prevent recurrence, aligning with secure development and deployment practices.0