An enterprise security team discovers that system administrators holding elevated credentials are being targeted by voice phishing (vishing) campaigns aimed at capturing out-of-band authentication codes. Despite 100% completion of the mandatory annual general security awareness course, several administrators compromised credentials during recent simulations. Which of the following approaches is the most effective human risk management intervention to mitigate this specific risk?
- Implement role-based micro-training and simulated vishing scenarios that enforce out-of-band identity verification protocols for privileged users.Answer
- BIncrease the frequency of standard email spear-phishing simulation campaigns for all enterprise personnel from annually to quarterly.
- CDeploy network intrusion prevention system rules to automatically block call-signaling protocols on corporate firewall boundaries.
- DReclassify the enterprise security awareness policy from an administrative guidance document to a detective security control in the risk register.
Answer
Implementing role-based micro-training and simulated vishing scenarios that enforce out-of-band identity verification protocols for privileged users is the most effective intervention.
Role-based training customizes security education to the specific threat landscape, access levels, and attack vectors associated with high-risk job functions. System administrators hold elevated permissions and are prime targets for vishing attacks attempting to harvest multi-factor authentication codes. Tailoring micro-training and practical vishing simulations with out-of-band verification procedures directly addresses the human risk associated with privileged roles.
Step-by-Step Solution
Key Concept
Role-based security awareness training and human risk management tailoring for privileged accounts.