Exam CISM topic 1 question 154 discussion

The correct answer is C - Recognized threat intelligence Communities as they have the required expertise to understand advance attacks. A. Peers may be competitors, so this could result in corporate espionage B. Giving this to the public is not advisable as malicious actors and amateurs may be in the midst. D. This is not a disaster recovery issue, but a security issue.

Recognized threat intelligence communities are the most relevant external entities for providing guidance on advanced attacks. These communities collect, analyze, and share timely and actionable threat intelligence, including information about emerging threats, tactics, techniques, and procedures (TTPs) used by advanced attackers. By leveraging such intelligence, organizations can proactively improve their defenses and respond more effectively to evolving threats.

C is the right answer. This is a security issue and threat intelligence communities will provide valuable resources and information.

But aren’t we taught that APT’s would be in threat intelligence communities and that they can be in your system for months before you even notice. If so there wouldn’t be anything about them in threat intelligence communities.

C. Recognized threat intelligence communities

A i guess