A systems administrator notices that one of the systems critical for processing customer transactions is running an end-of-life operating system…

When a critical system runs an end-of-life (EOL) operating system, it means it no

longer receives security updates and is highly vulnerable. Placing the system in an

isolated Virtual Local Area Network (VLAN) is a crucial security technique. This

network segmentation limits the system's exposure to the rest of the enterprise network

and restricts its ability to affect other systems if compromised. This containment

strategy reduces the attack surface and mitigates the risk associated with unpatchable

vulnerabilities, thereby increasing enterprise security while the system might still be

operational due to its critical nature.

· A. Installing HIDS on the system: While a Host-based Intrusion Detection System

(HIDS) can detect attacks, it doesn't prevent exploitation of the EOL OS's inherent

vulnerabilities. Furthermore, HIDS compatibility and effectiveness on an unsupported

OS may be limited. It's a detection control, not a primary preventative measure for EOL

risks.

· C. Decommissioning the system: This is the most secure long-term solution as it

eliminates the risk. However, the question asks for a "technique to increase enterprise

security" for a critical, operational system. Decommissioning removes the system, rather

than securing its ongoing operation if it's still essential and a replacement isn't

immediately available.

· D. Encrypting the system's hard drive: Full-disk encryption protects data at rest (e.g.,

if the physical hardware is stolen). It does not protect against network-based attacks or

active exploitation of vulnerabilities while the EOL operating system is running.

1. NIST Special Publication 800-82 Rev. 3: Guide to Operational Technology (OT)

Security

o URL: https://doi.org/10.6028/NIST.SP.800-82r3

o Specific Location: Section 3.3.3.2 "Network Segmentation" states, "Network

segmentation is a common security practice for OT environments, as many OT systems

may be older legacy systems that lack robust security capabilities or cannot be easily

patched. Segmentation helps protect these systems by limiting network exposure..."

This principle directly supports isolating vulnerable (e.g., EOL) systems.

2. NIST Cybersecurity Framework (CSF)

o URL: https://www.nist.gov/cyberframework

o Specific Location: The "Protect" (PR) function, specifically PR.AC-5 (Network

Segmentation) and PR.PT-4 (Communications and Control Networks are Protected),

advocates for segmentation to protect assets and limit the impact of cybersecurity

events. Isolating an EOL system aligns with these protective measures.

3. Microsoft Documentation: Security best practices for Windows Server

(General principle applicable to EOL systems)

o While specific EOL documents often urge migration, the principle of isolation as a

compensating control is widely recognized in Microsoft's security guidance when

immediate migration isn't feasible. For instance, guidance for older systems like

Windows XP or Server 2003, when they went EOL, included recommendations to

isolate them if they couldn't be immediately decommissioned or upgraded. (A general

search for "Microsoft end of life server security guidance isolate" will yield numerous

articles from Microsoft and its partners echoing this).

o Example (Conceptual, linking to authoritative vendor principles): Microsoft

Security Best Practices often detail layered security. For a system that cannot be

patched (like EOL systems), network isolation becomes a critical layer of defense, as

described in many security architecture documents. An example is the concept of

"Protect your network" in various Windows Server security guides.

4. NIST Blog: "Unsupported Software: A Recipe for Disaster" by Murugiah Souppaya

(August 6, 2019)

o URL: https://www.nist.gov/blogs/cybersecurity-insights/unsupported-softwarerecipe-disaster

o Specific Location: The blog states, "If you can’t get rid of it [unsupported software],

isolate it. Consider putting the system(s) on a separate, isolated network segment. This

will limit any potential damage to only that segment." This directly supports option B.