Examkin

Question

Difficulty: Very hardSecurity Awareness Programs and Human Risk Management

A healthcare organization recently modified its human risk management framework after evaluating performance metrics across high-risk departments during simulated phishing campaigns. The IT operations team achieved a low phishing click-through rate of 2%2\%, but their mean time to report (MTTR) credential-harvesting simulations was 18 hours. Conversely, the medical billing department registered an 8%8\% click-through rate, yet 85%85\% of received phishing simulations were reported to the Security Operations Center (SOC) within 15 minutes of delivery. To accurately calibrate the organization's human risk posture and implement targeted security awareness interventions, which of the following actions represents the most effective security program strategy?

  1. Develop a composite Human Risk Score (HRS) incorporating reporting velocity and incident amplification metrics alongside click-through rates, while deploying specialized microlearning on timely incident escalation for IT operations.Answer
  2. B
    Reconfigure the Secure Email Gateway (SEG) to automatically drop all external emails containing embedded hyperlinks sent to the IT operations department.
  3. C
    Mandate an annual multi-hour security awareness lecture focused on identifying vishing and smishing tactics for the medical billing department.
  4. D
    Deploy hardware token multi-factor authentication (MFA) to act as a deterrent control that discourages medical billing employees from clicking suspicious phishing links.

Answer

Develop a composite Human Risk Score (HRS) incorporating reporting velocity and incident amplification metrics alongside click-through rates, while deploying specialized microlearning on timely incident escalation for IT operations.
The correct strategy establishes a comprehensive Human Risk Score (HRS) that incorporates both reporting speed and click-through rates. In human risk management, rapid reporting by end users turns the workforce into a distributed detection network, significantly reducing threat dwell time. Because IT operations delayed reporting for 18 hours, targeted microlearning on escalation pathways directly resolves the critical behavioral risk identified in the metrics.

Step-by-Step Solution

1
Analyze the departmental metric disparity.
Identified that IT operations has low susceptibility (2%2\%) but high dwell time vulnerability due to delayed reporting (18 hours), whereas medical billing has higher susceptibility (8%8\%) but functions as an active detection sensor (85%85\% fast reporting).
Evaluating click-through rates alone creates a false sense of security, ignoring the risk posed by un-reported active phishing attacks.
2
Evaluate risk framework alignment for human risk management.
A holistic awareness program measures mean time to report (MTTR) and user reporting rates to calculate true enterprise human risk.
Fast employee reporting reduces adversary dwell time and enables SOC security controls to block active threats across the enterprise.
3
Select the appropriate administrative intervention.
Combining composite scoring with targeted microlearning addresses the root operational flaw in IT operations without disrupting legitimate business workflows.
Tailored role-based microlearning provides continuous, actionable feedback specific to the identified behavior.

Key Concept

Human Risk Metrics and Role-Based Security Awareness Calibration
Rate this question

Topics

Security Awareness Programs and Human Risk Management

More questions from this topic