Certified Incident Handler (CIH) Practice Ecam

What is a practice an incident handler should avoid during eradication of email security incidents?

1. Check each email for validity

2. Uninstall tools that detect phishing emails

3. Alert users about potential threats

4. Use two-factor authentication

The correct answer is: Uninstall tools that detect phishing emails

During the eradication of email security incidents, uninstalling tools that detect phishing emails is a practice that should be avoided because it removes an essential layer of protection against ongoing threats. Phishing emails are one of the primary methods cybercriminals utilize to compromise sensitive information or gain unauthorized access to systems. By having these detection tools active, incident handlers can better monitor for malicious activity, reduce the chances of future attacks, and help protect users from falling victim to phishing schemes. Maintaining these tools is critical during the eradication phase as it ensures continued vigilance and response capabilities. It also aids in gathering data on any potential threats that may still be active in the environment, which is valuable for learning and improving overall incident response strategies. In contrast, checking each email for validity, alerting users about potential threats, and using two-factor authentication are all sound practices to enhance email security and mitigate risks during this process. These measures contribute to a robust defense and increase user awareness of ongoing threats.