An operating system (OS) noncritical patch to enhance system security cannot be applied because a critical
application is not compatible with the change. Which of the following is the BEST solution?

A.
Rewrite the application to conform to the upgraded operating system

B.
Compensate for not installing the patch with mitigating controls

C.
Alter the patch to allow the application to run in a privileged state

D.
Run the application on a test platform; tune production to allow patch and application

Explanation:

Since the operating system (OS) patch will adversely impact a critical application, a mitigating control should be identified that will provide an equivalent level of security. Since the application is critical, the patch should not be applied without regard for the application; business requirements must be considered. Altering the OS patch to allow the application to run in a privileged state may create new security weaknesses. Finally, running a production application on a test platform is not an acceptable alternative since it will mean running a critical production application on a platform not subject to the same level of security controls.