Certified Incident Handler (CIH) Practice Ecam

Which of the following practices will not help incident responders prepare to handle insider threats in an organization?

1. Provide elevated privileges to the employees to perform their duties

2. Implement a robust training program on security awareness

3. Conduct regular vulnerability assessments

4. Establish clear policies for data access

The correct answer is: Provide elevated privileges to the employees to perform their duties

Providing elevated privileges to employees represents a risk factor in the context of insider threats. While elevated privileges may be necessary for certain roles to perform their functions, this practice can also inadvertently increase the risk of misuse or abuse of access by those insiders, especially if they have malicious intent or if their accounts are compromised. In contrast, implementing a robust training program on security awareness educates employees about potential threats and promotes a culture of security. Conducting regular vulnerability assessments helps identify potential weaknesses in systems that could be exploited by insiders or outsiders. Establishing clear policies for data access ensures that employees understand the boundaries of their access rights, minimizing the chances of unauthorized data exposure. Therefore, the practice of providing elevated privileges does not contribute positively to the organization's preparedness to handle insider threats.