Exam CISM topic 1 question 221 discussion

Having a skilled information security team would be the best way to help an organization's ability to manage advanced persistent threats (APTs). Advanced persistent threats are a type of cyber attack that is typically carried out by highly skilled and well-funded attackers. In order to effectively defend against APTs, an organization needs a team of skilled security professionals who are able to identify, analyze and respond to these threats. This team should be well-versed in the latest threat intelligence, and have the technical expertise to design, implement and maintain advanced security controls. While Increasing the information security budget and using multiple security vendors can also be beneficial, they are not as crucial as having a skilled information security team. Having network detection tools in place is also an important aspect of APT management, but it alone is not sufficient to manage APTs as it is only a part of the larger security strategy.

A. Having a skilled information security team Managing advanced persistent threats (APTs) effectively requires a combination of technical solutions, strategic planning, and most importantly, expertise. A skilled information security team is best equipped to understand the complex nature of APTs, apply the necessary countermeasures, and adapt to the evolving threat landscape. While increasing budgets, using multiple vendors, and implementing detection tools are supportive actions, the core capability to strategically manage APTs hinges on the expertise and skills of the security team.

I would say Tools since it is an exam where you think like a Manager..Having the right tools especially detection tools that is designed to respond and manage these types of alerts . Having a skill team is important but the tools was also designed by skilled people. If i was a manager I would get the tool to manage the incident.

It mention "manage" which pretty much incident response. Skilled IS team will have better understanding and reacting to it. With IDS in place, it does help detect APT but doesn't mean it is able to manage to a acceptable level.

Without the proper visibility skilled IS team can not deal with APT.

It says "to manage" not to "detect".. to manage the situations created by APT I would use A... Not clear wording...

D. Having network detection tools in place Having network detection tools in place is arguably the most crucial element in this context. APTs are sophisticated and often stealthy attacks that can go unnoticed for a long time. Network detection tools, such as Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), are specifically designed to monitor network traffic and identify suspicious activities or patterns that may indicate the presence of APTs.

How about B? Without B no skilled team, no advanced tools, no nothing. Especially since APTs are very complex thing requiring a holistic approach to managing (detecting and defending from).

Having a skilled team beat having a network tool. APT happens across different vector. A skilled team will know how and what is needed for APT detection.

A skilled information security team possesses the knowledge, expertise, and experience necessary to detect, analyze, and respond to advanced persistent threats effectively. APTs are typically highly sophisticated and require specialized skills to address. Threat Intelligence: Skilled professionals can actively monitor emerging threat landscapes, identify APT indicators, and adapt security measures accordingly. Incident Response: They are proficient in incident response practices, enabling them to rapidly respond to APT incidents, contain the threat, and minimize damage. Having network detection tools in place is an important part of APT defense, but without skilled professionals to configure, monitor, and respond to alerts generated by these tools, their value is limited.

D. Having network detection tools in place Having network detection tools in place is arguably the most crucial element in this context. APTs are sophisticated and often stealthy attacks that can go unnoticed for a long time. Network detection tools, such as Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), are specifically designed to monitor network traffic and identify suspicious activities or patterns that may indicate the presence of APTs.

D. Having network detection tools in place.

D. Having network detection tools in place

The BEST option to help an organization manage advanced persistent threats (APT) is to have network detection tools in place. These tools, such as intrusion detection and prevention systems, network behavior analysis tools, and security information and event management systems, can help identify and respond to APTs in real-time. While having a skilled information security team, increasing the information security budget, and using multiple security vendors can all contribute to an organization's overall security posture, they may not specifically address the unique challenges presented by APTs.

Believe the key word is manage... looking at each of these answers... APT's would be best MANAGED via A

It can be A or D. You can detect APTs by using tools like UEBA, deception technology, and network monitoring.