Full Access ISC CC Tutorials

Firewalls are not particularly effective against insider threats because insiders already have authorized access to internal systems and networks. Firewalls are designed to control traffic between trusted and untrusted networks, not to monitor legitimate internal user behavior.

Least privilege limits what insiders can access, reducing potential damage. Background checks help identify risky individuals before hiring. Separation of duties prevents any one person from having complete control over critical processes.

Insider threats involve misuse of legitimate access, whether malicious or accidental. Effective controls against insiders focus on access management, monitoring, auditing, and behavioral analysis—not perimeter defenses.

Security frameworks consistently emphasize that insider threats require administrative, detective, and procedural controls rather than traditional network perimeter tools like firewalls.

According to NIST SP 800-61, incident response consists of four core phases:Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Option A best represents these core components.

When incidents escalate beyond containment and business continuity measures are insufficient, theDisaster Recovery Plan (DRP)is activated to restore IT systems and infrastructure.

Two-Person Integrityensures no single individual can complete a sensitive action alone, reducing fraud and insider threats.