An enterprise security administrator is formalizing an operational workflow to handle human risk incidents, progressing from initial end-user detection of a spear-phishing attempt to enterprise-wide awareness training improvements. Place the following procedural steps in the correct chronological order from first to last.
- 1The end user identifies suspicious indicators in an incoming email message and submits it via the automated phishing report button.
- 2The Security Operations Center (SOC) triages the reported message, confirms malicious intent, and purges matching indicators from user inboxes.
- 3The security awareness team analyzes the incident data to identify specific human risk gaps and targeted employee groups.
- 4Targeted micro-learning modules and simulated phishing exercises relevant to the attack vector are deployed to high-risk personnel.
- 5Metrics detailing reporting latency, click-through rates, and training completion are presented to oversight governance committees to refine policy.
Cevap
The correct procedural order is: 1) End user reports suspicious email; 2) SOC triages and performs technical containment; 3) Security awareness team analyzes human risk trends; 4) Targeted micro-learning modules are deployed; 5) Program metrics are escalated to governance committees for policy updates.
The procedural sequence follows a logical lifecycle starting with end-user identification and reporting, followed by technical SOC incident triage and containment. Once the threat is remediated, the human risk program analyzes targeted vulnerabilities, deploys micro-learning tailored to those vectors, and finally aggregates reporting metrics for executive governance and security awareness policy escalation.
Adım Adım Çözüm
Anahtar Kavram
Incident-driven Human Risk Management Lifecycle