Embedded facility automation systems are often difficult to upgrade because they are constrained by available compute. These systems typically have limited processing power, memory, and storage, which restricts the ability to implement modern security measures, such as encryption, software updates, or advanced security controls. Security engineers may be unable to apply patches or updates without exceeding the system's capacity. CASP+ discusses the challenges posed by resource-constrained devices, particularly in embedded systems and IoT environments, where upgrading security can be difficult due to hardware limitations.
Reference:
CASP+ CAS-004 Exam Objectives: Domain 3.0 - Enterprise Security Architecture (Embedded System Security and Constraints) CompTIA CASP+ Study Guide: Managing Security for Resource-Constrained Embedded Systems

To prevent ransomware attacks and protect IT assets, the most secure options are:
Endpoint Detection and Response (EDR): Provides advanced threat detection, real-time monitoring, and response capabilities, which can help identify and mitigate ransomware attacks before they spread.
Sandboxing: Isolates suspicious files or software in a controlled environment where they can be analyzed for malicious behavior without affecting production systems.
Application Control: Ensures that only whitelisted, trusted applications can run, which can prevent ransomware from executing unauthorized or malicious code.Together, these controls provide a robust defense against ransomware by addressing detection, isolation, and prevention. CASP+ emphasizes the importance of combining detection and prevention strategies to mitigate sophisticated attacks like ransomware.
Reference:
CASP+ CAS-004 Exam Objectives: Domain 2.0 - Enterprise Security Operations (Endpoint Protection, Ransomware Mitigation) CompTIA CASP+ Study Guide: Mitigating Ransomware with EDR, Sandboxing, and Application Control

Reference:
A trusted secrets manager is a tool or service that securely stores and manages sensitive information, such as passwords, API keys, tokens, certificates, etc. A trusted secrets manager can help secure the company's CI/CD (Continuous Integration/Continuous Delivery) pipeline by preventing hard-coding sensitive environment variables in the code, which can expose them to unauthorized access or leakage. A trusted secrets manager can also enable encryption, rotation, auditing, and access control for the secrets. Reference: https://www.hashicorp.com/resources/what-is-a-secret-manager https://dzone.com/articles/how-to-securely-manage-secrets-in-a-ci-cd-pipeline

Avoiding the risk by shutting down the application and migrating to a supported, alternative platform is the most effective option based on the provided scenario. The application is non-critical, provides no revenue, and replacing it has a nominal cost, making risk avoidance the ideal choice. This aligns with the CASP+ objective of implementing risk strategies (1.3) and emphasizes prioritizing cost-effective and practical solutions over maintaining deprecated or vulnerable systems.