A security expert is investigating a breach that resulted in a $32 million loss from customer accounts.
Hackers were able to steal API keys and two-factor codes due to a vulnerability that was introduced in a new code a few weeks before the attack.
Which step was missed that would have prevented this breach?
Click on the arrows to vote for the correct answer
A. B. C. D.D.
https://securityintelligence.com/how-to-prioritize-security-vulnerabilities-in-secdevops/The correct answer to this question is D. The use of SecDevOps to detect the vulnerability during development was missed, which would have prevented the breach.
SecDevOps, also known as DevSecOps, is an approach to software development that incorporates security into the development process from the start. It involves integrating security into the development pipeline, using automated security testing tools, and implementing security best practices throughout the development lifecycle.
In this scenario, a vulnerability was introduced into the new code a few weeks before the attack. If the development team had used SecDevOps, they could have detected the vulnerability during development and addressed it before the code was deployed. This would have prevented the hackers from being able to steal the API keys and two-factor codes that led to the $32 million loss from customer accounts.
Option A, the use of the Nmap tool to identify the vulnerability when the new code was deployed, would not have prevented the breach. Nmap is a network exploration tool used to scan networks and identify open ports, hosts, and services. While it can be useful for identifying vulnerabilities, it is not designed to be used in the development process.
Option B, the implementation of a firewall and intrusion detection system, is a good security practice, but it would not have prevented the breach in this scenario. The hackers were able to steal the API keys and two-factor codes because of a vulnerability in the new code, not because of a lack of a firewall or intrusion detection system.
Option C, the implementation of an endpoint protection system, would also not have prevented the breach in this scenario. Endpoint protection systems are designed to protect endpoints, such as laptops and mobile devices, from malware and other threats. They would not have prevented the hackers from stealing the API keys and two-factor codes.