Certified Incident Handler (CIH) Practice Ecam

Which step should an incident handler avoid while addressing email security incidents?

1. Establish secure communication channels

2. Provide training on email safety

3. Establish email-dependent communication channels to report incidents

4. Implement email filtering solutions

The correct answer is: Establish email-dependent communication channels to report incidents

Establishing email-dependent communication channels to report incidents should be avoided because it can undermine the overall effectiveness and security of the incident response process. When dealing with email security incidents, relying on the same medium that may be compromised to communicate about the incident poses a significant risk. Attackers could potentially intercept communications or exploit known vulnerabilities in the email system, which may lead to further breaches or information leaks. On the other hand, the other methods being considered are essential and enhance overall incident response strategies. For example, secure communication channels ensure that sensitive information shared during an incident response is protected from interception. Providing training on email safety equips users to recognize potential threats and adopt safe practices, which decreases the likelihood of future incidents. Implementing email filtering solutions is vital for mitigating risks by blocking malicious content or phishing attempts before they reach users.