[Endpoint Protection and Detection] A company has 5000 Windows users on its campus. Which two precautions should IT take to prevent WannaCry…

WannaCry ransomware is a type of malware that encrypts the files on the infected devices and

demands a ransom for their decryption. It exploits a vulnerability in the Windows SMB protocol that

allows remote code execution. To prevent WannaCry ransomware from spreading to all clients, IT

should take the following precautions:

Ensure that noncompliant endpoints are segmented off to contain any potential damage. This means

that any device that is not patched, managed, or compliant with the security policies should be

isolated from the rest of the network and given limited access to resources. This can be done using

Cisco Identity Services Engine (ISE) and Cisco TrustSec, which can enforce dynamic segmentation

based on the device’s identity, posture, and context. This way, IT can prevent the ransomware from

infecting other devices and reduce the impact of the attack12

Perform a posture check to allow only network access to those Windows devices that are already

patched. This means that IT should verify that the devices have installed the latest security updates

from Microsoft that fix the SMB vulnerability. This can be done using Cisco AnyConnect Secure

Mobility Client, which offers a VPN Posture/HostScan Module and an ISE Posture Module. Both

modules can assess the endpoint’s compliance for things like operating system, patches, antivirus,

antispyware, and firewall software. If the device is not patched, it can be denied access to the

network or redirected to a remediation portal13

: 1: Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.0 - Configure

Posture 2: Can We Trust Your Device? Checking Security Posture - Cisco 3: Cisco AnyConnect Secure

Mobility Client Administrator Guide, Release 4.10 - Configure Posture