Examkin

Question

Difficulty: MediumSecurity Awareness Programs and Human Risk Management

Following a simulated security assessment, a company discovers that executive assistants frequently disclose sensitive internal scheduling information and bypass identity verification during unexpected phone calls from individuals impersonating C-suite executives. Which of the following strategies represents the most effective human risk management control to address this specific vulnerability?

  1. A
    Deploying automated email content filtering to flag messages containing urgent financial or scheduling language
  2. Implementing targeted, role-based security training focused on out-of-band verification procedures for high-risk personnelAnswer
  3. C
    Mandating annual general security awareness refresher training for all enterprise employees
  4. D
    Enforcing SPF, DKIM, and DMARC record policies across domain email servers

Answer

Implementing targeted, role-based security training focused on out-of-band verification procedures for high-risk personnel.
Role-based security awareness training tailors instruction to the specific threats, operational tasks, and risk profiles of specialized user groups. Executive assistants face targeted pretexting and vishing attempts; establishing clear out-of-band verification procedures through role-specific training directly addresses human vulnerability where standard technical controls cannot intervene.

Step-by-Step Solution

1
Analyze the identified vulnerability in the scenario
The vulnerability stems from human risk during voice phone calls (vishing/pretexting) targeted at executive assistants.
Understanding the attack vector (voice phone calls) and target demographic (executive assistants) is required to select an effective control.
2
Evaluate control options against the threat vector
Technical controls like email filters or DMARC target email vectors, not phone calls. General training fails to provide specific procedural steps for specialized roles.
Controls must match the specific attack vector and administrative requirement.
3
Select the optimal human risk mitigation control
Role-based training tailored to executive assistants establishing out-of-band verification directly mitigates pretexting risks.
Tailored training ensures high-risk personnel know how to verify callers through secondary channels before releasing sensitive information.

Key Concept

Role-Based Security Training and Human Risk Management
Estimated Time:1m 30s
Rate this question

Topics

Security Awareness Programs and Human Risk Management

More questions from this topic