Certified Incident Handler (CIH) Practice Ecam

Which of the following practices will not help an incident handler while performing recovery after an insider threat?

1. Ensure that irregular backups are performed and tested for integrity and availability

2. Implement "immutable" and "unbreakable" backups

3. Perform thorough training on incident response procedures

4. Establish a communication plan with stakeholders

The correct answer is: Ensure that irregular backups are performed and tested for integrity and availability

The practice that provides the least help in the context of recovery after an insider threat is ensuring that irregular backups are performed and tested for integrity and availability. While having backups is critical for recovery, the term "irregular" implies inconsistency in the backup process. For effective recovery, practices must be systematic and reliable. Regular, well-managed backups help ensure that up-to-date and accurate data is available for restoration. In contrast, implementing "immutable" and "unbreakable" backups specifically addresses the need to protect backup data from alteration or deletion, which is crucial when facing insider threats where malicious actors may attempt to erase their tracks or compromise data integrity. Thorough training on incident response procedures is also essential as it equips incident handlers and relevant staff with the necessary skills to respond promptly and effectively during an incident, which includes recovery processes after an insider threat. Establishing a communication plan with stakeholders helps to ensure that all parties are informed, minimizing confusion and ensuring coordinated actions during recovery efforts. Thus, the focus should always be on consistent and reliable backup processes, as opposed to irregular methods, for effective recovery after an insider threat.