Certified Incident Handler (CIH) Practice Ecam

What practice will help incident responders prepare for handling insider threats?

1. Use employee monitoring software to track computer activities

2. Assume employees always act in the best interest of the organization

3. Neglect the development of access control lists

4. Prioritize customer data over employee data

The correct answer is: Use employee monitoring software to track computer activities

Using employee monitoring software to track computer activities is a proactive practice that can significantly aid incident responders in preparing for insider threats. This approach allows organizations to closely observe and analyze user behavior, helping to identify unusual patterns or anomalies that may indicate malicious intent or negligent behavior among employees. By monitoring activities such as file access, data transfers, and application usage, responders can gather valuable insights that contribute to better risk assessment and incident detection. This practice also fosters an environment of accountability, as employees are aware that their actions are being monitored, which may deter potential insider threats. Furthermore, data collected through monitoring can provide critical evidence in the event of a security incident, facilitating a more efficient response. Prioritizing employee monitoring aligns with the overall goal of enhancing organizational security, especially considering that insider threats can be just as damaging as external attacks.