Certified Incident Handler (CIH) Practice Ecam

Which recovery strategy is essential after handling an insider threat?

1. Implement a person-to-person rule for backups

2. Use cloud storage for all backups

3. Allow unrestricted access to backup resources

4. Discard old backups immediately

The correct answer is: Implement a person-to-person rule for backups

Implementing a person-to-person rule for backups is a crucial recovery strategy after handling an insider threat. This approach helps ensure that backup processes are carried out with a level of accountability and oversight. By requiring that two individuals are involved in the creation, storage, and recovery of backups, organizations can reduce the likelihood of further data manipulation or deletion by individuals with malicious intent. This strategy not only enhances security but also establishes checks and balances in the backup process, thereby minimizing risks associated with insider threats. In addition to enhancing security, this method fosters a culture of collaboration and diligence within the organization when managing critical data. It also provides a clear audit trail, making it easier to track any actions taken with sensitive data, which is particularly valuable when recovering from an incident involving insider threats. The effectiveness of this strategy stands in contrast to the other options, which may not provide a structured approach to dealing with backup integrity and security in the aftermath of insider threats.