Question

A financial services company runs a legacy transaction system that cannot support multifactor authentication due to vendor limitations. The application processes high-value payments and must remain in service for 18 months until replacement. The information security manager needs to reduce the risk of unauthorized access during this period without modifying the application. Which control approach is MOST appropriate?

Accepted Answer

Implement compensating controls such as network segmentation, jump-host access with MFA, and enhanced session monitoring

Answer

Document a formal risk acceptance and take no additional action until the system is replaced

Answer

Require the vendor to add multifactor authentication as an emergency change before continued use

Answer

Disable all remote access to the system and rely solely on physical access controls