Defense in Depth Quiz

Select 3 distinct methods through which the Nimda worm spread?

• Email

• Windows file shares

• Notepad

• HTTP browsing

Select 2 methods the company could have used the perimeter to mitigate Nimda?

• Using routers to block or restrict web access

• Using hard drive software to mitigate Nimda

• Using hubs to block or restrict file access

• Using rate-limiting switch to dampen the effects of a DoS

What could have mitigated Nimda on the internal network?

• Using routers to block or restrict web access

• Using proxy firewalls to block known strings within Nimda

• Using host-centric firewalls capable of blocking IIS and windows file share access

• Using antivirus software to mitigate Nimda

What was the highest potential of success in blocking Nimda?

• Using antivirus software

• Robust security policy

• Regular audits

• Host hardening

What could have helped mitigate the spread of Nimda?

• Host hardening

• Regular audits

• Antivirus software

• Robust security policy

Why did Nimda run rampant when so many methods were available to mitigate its spread?

• Organizations had the wrong pieces of defense in depth in place

• All of the above

• Organizations didn't follow policy

• Organizations had one or more important components of defense in depth missing

What could have prevented infection via email?

• Using antivirus software to mitigate Nimda

• Using host-centric firewalls capable of blocking IIS and windows file share access

• Establishing a user-awareness program

• Using routers to block or restrict web access

What could have stopped all four propagation methods of Nimda?

• Applying the patch for the vulnerability

• Regular audits

• Using antivirus software

• Robust security policy

What could have isolated sections of the network to patch the vulnerabilities or contain the spread of the worm?

• Antivirus software

• Regular audits

• Robust security policy

• Incident-handling procedure

What might have prevented infection via email?

• Establishing a user-awareness program

• Using antivirus software to mitigate Nimda

• Using routers to block or restrict web access

• Using host-centric firewalls capable of blocking IIS and windows file share access