Which risk management strategy will ensure the secure configuration and deployment of a new supply chain management system and prevent identity theft?

Implementing multifactor authentication (MFA) is the most direct and effective strategy to prevent identity theft while contributing to the secure deployment of a new system. MFA requires users to provide two or more verification factors to gain access, such as something they know (password), something they have (token), and something they are (biometric). This layered approach ensures that even if an attacker compromises one factor, like a password, they cannot impersonate the user and access the system. This control is a foundational element of modern identity and access management (IAM) and is critical for securing sensitive systems like supply chain management.

A. A strict firewall policy is a network-level control that filters traffic. It does not verify user identity and cannot prevent access by an attacker using stolen credentials from an allowed network location.

B. Disabling USB ports is an endpoint hardening technique to prevent data exfiltration or malware introduction. It does not address authentication or prevent unauthorized remote login attempts.

C. Vulnerability scanning and patch management are crucial for mitigating risks from software flaws. However, they do not directly prevent an attacker from using legitimate, but stolen, credentials to access the system.

1. National Institute of Standards and Technology (NIST) Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management. Section 5.1.1, "Memorized Secrets," states, "Verifiers SHALL require a second factor in addition to a memorized secret... The use of a second factor is required to mitigate the risk of compromise of the memorized secret." This directly supports MFA as a control against compromised credentials (identity theft).

2. National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations. Control IA-2, "Identification and Authentication (Organizational Users)," specifically includes enhancements for using multifactor authentication to establish stronger identity verification for system access, highlighting its role in secure system architecture.

3. Carnegie Mellon University, Software Engineering Institute (SEI), Best Practices in Cyber Supply Chain Risk Management. In various publications, the SEI emphasizes strong authentication and access control as a core principle for securing the supply chain. For example, the report "Cyber Supply Chain Risk Management: A GSA Perspective" (CMU/SEI-2021-SR-011), Section 3.2, discusses the importance of controlling access to sensitive information, for which MFA is a primary mechanism.