A system administrator has been alerted to a zero-day vulnerability that is impacting a service enabled on a server OS. Which of the following would work BEST to limit an attacker from exploiting this vulnerability?

A zero-day vulnerability is a software flaw unknown to the vendor, meaning no official patch or fix is available. Therefore, installing patches is not a possible solution. The vulnerability is described as impacting a specific service, which communicates over the network via designated ports. The most effective and immediate mitigation strategy to prevent exploitation is to remove the attack vector. By closing the port associated with the vulnerable service, the administrator makes the service inaccessible from the network, thereby preventing attackers from reaching and exploiting the flaw until a permanent patch can be developed and applied.

A. Installing the latest patches: This is incorrect because a patch does not exist for a zero-day vulnerability by definition.
C. Enabling antivirus protection: Antivirus software relies primarily on signatures of known threats and is unlikely to detect or prevent a novel zero-day exploit.
D. Enabling a NIDS: A Network Intrusion Detection System (NIDS) is a passive tool that can only detect and alert on suspicious activity; it cannot block or prevent an attack. ---

1. Cybersecurity and Infrastructure Security Agency (CISA). In advisories for zero-day vulnerabilities

CISA frequently recommends immediate mitigations that involve limiting access. For example

in the advisory for the Log4j vulnerability (CVE-2021-44228)

a primary mitigation was to "Disable the JNDI lookup feature" or implement firewall rules to block traffic to affected ports

effectively removing the attack surface before a patch was widely available. This principle is detailed in various CISA alerts.

Source: CISA

"Apache Log4j Vulnerability Guidance

" December 2021. (The guidance illustrates the principle of disabling services or blocking access as a primary mitigation for an unpatched vulnerability).

2. National Institute of Standards and Technology (NIST). NIST SP 800-53 Rev. 5

"Security and Privacy Controls for Information Systems and Organizations

" control SI-2 (Flaw Remediation) discusses the process for correcting flaws. While it prioritizes patching

the framework's risk-based approach implies that when a patch is unavailable (as in a zero-day)

other controls must be used to mitigate risk

such as those under AC-4 (Information Flow Enforcement)

which includes blocking access to services at managed interfaces (e.g.

firewalls blocking ports).

Source: NIST Special Publication 800-53 Revision 5

Control: AC-4

Page 103.

3. Carnegie Mellon University

Software Engineering Institute. The CERT Coordination Center (CERT/CC) provides guidance on vulnerability response. Their published best practices emphasize that if a patch is not available

administrators should consider disabling the affected service or blocking network traffic as a temporary workaround to prevent exploitation.

Source: CERT/CC

"Best Practices for Responding to Intrusions

" Section: Containment. This document outlines steps to limit the scope of an incident

where disabling vulnerable services is a key tactic.