The risk manager is reviewing a report which identifies a requirement to keep a business critical
legacy system operational for the next two years. The legacy system is out of support because the
vendor and security patches are no longer released. Additionally, this is a proprietary embedded
system and little is documented and known about it. Which of the following should the Information
Technology department implement to reduce the security risk from a compromise of this system?
A.
Virtualize the system and migrate it to a cloud provider.
B.
Segment the device on its own secure network.
C.
Install an antivirus and HIDS on the system.
D.
Hire developers to reduce vulnerabilities in the code.