Certified Incident Handler (CIH) Practice Ecam

Which ENISA best practice recommends subscribing to services that provide information about compromised machines?

1. Threat Intelligence

2. Incident report

3. Vulnerability Disclosure

4. Post-Incident Review

The correct answer is: Incident report

The best practice focused on subscribing to services that provide information about compromised machines aligns with Threat Intelligence. Threat Intelligence involves collecting and analyzing data regarding potential threats, including information on compromised systems, vulnerabilities, and other indicators of compromise. Utilizing threat intelligence services offers organizations timely updates on emerging threats and compromised machines, enabling them to strengthen their defenses and mitigate risks effectively. Such intelligence helps in proactive threat hunting and timely incident response, ensuring that security teams are informed of the latest threats impacting their network. The other practices mentioned serve different purposes. Incident report focuses on documenting and analyzing specific incidents after they occur, whereas Vulnerability Disclosure pertains to processes for reporting and resolving software vulnerabilities. A Post-Incident Review is centered on assessing response efforts after an incident. None of these specifically highlight the strategic aspect of obtaining real-time information about compromised systems, which is a core component of Threat Intelligence.