A security team audit reveals that a USB drive was inserted into several servers before multiple login attempts were made. What action should be taken to close the vulnerability?

A security team audit reveals that a USB drive was inserted into several servers before multiple login attempts were made. What action should be taken to close the vulnerability?

• A. Disable guest account
• B. Remove admin permissions
• C. Modify AutoRun settings
• D. Change default credentials

Answer: (A)

The most effective action to close the vulnerability highlighted by the security team audit is to disable the guest account. Guest accounts generally have limited access privileges; however, if they are enabled, they can still be exploited by unauthorized users. A USB drive, especially if it contains malicious software, can be a means for an attacker to gain access to sensitive systems. By disabling the guest account, the organization minimizes the risk of unauthorized users accessing the system without proper credentials, thereby reducing the potential impact of an attack through physical access, such as that represented by the use of a USB drive. This is vital in securing systems where administrative activities may occur, ensuring that all interactions must occur under properly authenticated sessions. While modifying AutoRun settings, changing default credentials, and removing admin permissions can certainly contribute to overall security hygiene, they do not directly address the immediate vulnerability that arises from the possibility of unauthorized access through a guest account on systems where a USB drive was found.

The most effective action to close the vulnerability highlighted by the security team audit is to disable the guest account. Guest accounts generally have limited access privileges; however, if they are enabled, they can still be exploited by unauthorized users. A USB drive, especially if it contains malicious software, can be a means for an attacker to gain access to sensitive systems.

By disabling the guest account, the organization minimizes the risk of unauthorized users accessing the system without proper credentials, thereby reducing the potential impact of an attack through physical access, such as that represented by the use of a USB drive. This is vital in securing systems where administrative activities may occur, ensuring that all interactions must occur under properly authenticated sessions.

While modifying AutoRun settings, changing default credentials, and removing admin permissions can certainly contribute to overall security hygiene, they do not directly address the immediate vulnerability that arises from the possibility of unauthorized access through a guest account on systems where a USB drive was found.