Examkin

Soru

Zorluk: OrtaSecurity Awareness Programs and Human Risk Management

Following a simulated security assessment, a company discovers that executive assistants frequently disclose sensitive internal scheduling information and bypass identity verification during unexpected phone calls from individuals impersonating C-suite executives. Which of the following strategies represents the most effective human risk management control to address this specific vulnerability?

  1. A
    Deploying automated email content filtering to flag messages containing urgent financial or scheduling language
  2. Implementing targeted, role-based security training focused on out-of-band verification procedures for high-risk personnelCevap
  3. C
    Mandating annual general security awareness refresher training for all enterprise employees
  4. D
    Enforcing SPF, DKIM, and DMARC record policies across domain email servers

Cevap

Implementing targeted, role-based security training focused on out-of-band verification procedures for high-risk personnel.
Role-based security awareness training tailors instruction to the specific threats, operational tasks, and risk profiles of specialized user groups. Executive assistants face targeted pretexting and vishing attempts; establishing clear out-of-band verification procedures through role-specific training directly addresses human vulnerability where standard technical controls cannot intervene.

Adım Adım Çözüm

1
Analyze the identified vulnerability in the scenario
The vulnerability stems from human risk during voice phone calls (vishing/pretexting) targeted at executive assistants.
Understanding the attack vector (voice phone calls) and target demographic (executive assistants) is required to select an effective control.
2
Evaluate control options against the threat vector
Technical controls like email filters or DMARC target email vectors, not phone calls. General training fails to provide specific procedural steps for specialized roles.
Controls must match the specific attack vector and administrative requirement.
3
Select the optimal human risk mitigation control
Role-based training tailored to executive assistants establishing out-of-band verification directly mitigates pretexting risks.
Tailored training ensures high-risk personnel know how to verify callers through secondary channels before releasing sensitive information.

Anahtar Kavram

Role-Based Security Training and Human Risk Management
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Security Awareness Programs and Human Risk Management

Bu konudan daha fazla soru