Exam CISM topic 1 question 502 discussion

C. the key word here is "prevent" which is what SOD and least privilege does. Logging is used for detective control.

Answer C will reduce the impact of insider attack. Logging in itself is not enough. The answer should be " logging with monitoring of anomalies.

some people are saying least privilege and roles can prevent insider attack, it wont. it will limit the impact due to limitation. best answer is user training. --> B

C. Enforce segregation of duties and least privilege access. Enforcing segregation of duties and implementing the principle of least privilege access means that employees are only granted access to the systems, data, and resources they need to perform their specific job functions. This reduces the risk of employees having unnecessary access to sensitive information and limits their ability to misuse or abuse their privileges.

C. Enforce segregation of duties and least privilege access.

This question talk about Threat; but not incident/risk. Even with least priority, the internal people still can be a threat to organization and it's assets(including physical threat); if there is no proper log, then can't find difficult to identify the threat too. If internal people knows who will be caught through logs, then he/she won't do any vulnerable activities.

C. Enforce segregation of duties and least privilege access.

Yea, D is clearly the most incorrect answer here. The question is asking about preventing. Logging is a detective control and has provides no value to the question.

C. the key word here is "prevent" which is what SOD and least privilege does. Logging is used for detective control

Preventing insider threats can be challenging as they are often caused by individuals with legitimate access to an organization's systems and data. However, implementing a combination of preventative measures can help mitigate the risk. Of the options listed, the BEST way to prevent insider threats is to enforce segregation of duties and least privilege access (Option C).

Clearly, C.

The key is prevent. Logs do not prevent.

C for me