Certified Incident Handler (CIH) Practice Ecam

Which of the following guidelines will not help an incident responder eradicate insider threats in an organization?

1. Disable access privileges to employees based on security incidents

2. Regularly update security software

3. Disable access privileges to employees or users based on the routine performance

4. Implement role-based access control

The correct answer is: Disable access privileges to employees or users based on the routine performance

The guideline that is identified as not helpful in eradicating insider threats is the one that suggests disabling access privileges to employees or users based on routine performance. This approach can inadvertently harm workplace efficiency and morale. Performance evaluations are often subjective and may not accurately indicate an individual's potential for security threats. Moreover, disabling access based solely on performance can overlook genuine employees' contributions and lead to unnecessary disruptions in daily operations. In contrast, the other options focus on proactive and preventive measures against insider threats. Disabling access privileges tied to security incidents ensures that any potential threats are promptly addressed, while regularly updating security software is essential for maintaining robust defenses against evolving threats. Role-based access control is a structured approach that limits access to only what is necessary for individuals to perform their job functions, further reducing the risk of insider threats. These strategies collectively form a security posture that is more effective in mitigating insider threats within an organization.