Certified Incident Handler (CIH) Practice Ecam

Which of the following guidelines will not help an incident responder eradicate insider threats in an organization?

1. Restrict access to sensitive information

2. Implement a tip line for reporting suspicious behavior

3. Allow file sharing, instant messaging, and other features among employees

4. Utilize two-factor authentication for access

The correct answer is: Allow file sharing, instant messaging, and other features among employees

The option that will not help an incident responder eradicate insider threats in an organization is the allowance of file sharing, instant messaging, and other features among employees. While collaboration and communication among employees can be essential for productivity, these features can inadvertently create opportunities for insider threats to manifest. For instance, unrestricted file sharing may lead to sensitive data being shared inappropriately or with unauthorized personnel, increasing the risk of data leaks or misuse. This creates potential vulnerabilities that could be exploited by individuals within the organization. In contrast, restricting access to sensitive information is a fundamental control that helps to limit the exposure of critical data, thereby reducing the chances of insider threats occurring. Implementing a tip line for reporting suspicious behavior fosters a culture of vigilance and encourages employees to communicate any concerns discreetly, making it harder for insider threats to go unnoticed. Meanwhile, utilizing two-factor authentication enhances security by adding an additional layer of confirmation for access to sensitive systems and data, further protecting against unauthorized actions even if an insider tries to bypass controls. Thus, allowing file sharing and similar features without proper oversight or restrictions can counteract the efforts to mitigate insider threats, making it a less effective guideline in this context.