Even if all possible technical safeguards are in place and functioning, __________ should occur to control the "human risk". (best answer)

Question

BlackTom AI · Accepted Answer

Security training and awareness is the administrative control that specifically targets human risk that technical safeguards cannot fully eliminate.

1) Relevant knowledge points and concepts
- Risk is comprised of technical, physical, and human factors. Technical safeguards (patches, firewalls, encryption) mitigate many vulnerabilities, but human factors—errors, social engineering, policy noncompliance, insider threats—remain. Security controls categories: technical, administrative (policies, training), and physical. Administrative controls are the primary means to reduce human-centric risks.

2) Step-by-step reasoning
- Step 1: Assume technical safeguards are in place and functioning.
- Step 2: Humans still interact with systems (click links, reuse passwords, misconfigure settings, bypass controls).
- Step 3: Social engineering (phishing), accidental data disclosure, and deliberate insider misuse exploit human behavior, not software flaws.
- Step 4: To change behavior, you need awareness, education, policies, and testing—i.e., security training and awareness programs.
- Step 5: Therefore, even with perfect technical controls, training reduces the remaining human risk.

3) Calculations
- No numeric calculations apply. The logical “residual risk” concept suffices: Total risk = technical risk + human risk. If technical risk → near zero, human risk still >0 unless addressed by administrative controls.

4) Why the correct answer is correct
- Security training and awareness directly addresses the root causes of human risk by teaching employees to recognize phishing, follow secure procedures, report incidents, and comply with policies—thus materially reducing successful human-targeted attacks.

5) Why other options are incorrect
- System patching: a technical control that fixes software vulnerabilities, not human behavior. IT architecture review: assesses system design, again technical/structural, not behavioral. System development: building or updating systems; does not primarily change user awareness or behavior.

6) Conclusion
- Security training and awareness is the appropriate control to manage human risk; this matches the provided correct answer: security training and awareness.

Even if all possible technical safeguards are in place and functioning, __________ should occur to control the "human risk". (best answer)单项选择题

类似问题

Which of the following can be used as a security measure to protect a network?

To stop users of a network from playing games all day instead of working, which would be the best security measure to use?

To stop users of a network from playing games all day instead of working, which would be the best security measure to use?

A cybersecurity strategist advises a small coffee shop that building customer trust through visible security practices, such as saying 'Your data is brewed safe here,' is as important as technical measures. This highlights which aspect of information security?

As the CISO of a eCommerce company you are troubled by high numbers of employees falling victim to malicious SPAM emails. You decide to implement a _________ program to hopefully reduce the number of victims within the company.

You own a bond that pays $64 in interest annually. The face value is $1,000 and the current market price is $1,021.61. The bond matures in 11 years. What is the yield to maturity?

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单