An enterprise wants to address the human factors of social engineering risk within the organization. From a governance perspective, which of the following is the BEST way to mitigate this risk?
Correct Answer: B
This is the best way to mitigate the human factors of social engineering risk within the organization from a governance perspective, as it helps to educate and empower the employees to recognize and prevent social engineering attacks. Social engineering attacks are malicious attacks that use deception and manipulation to exploit human behavior and trick people into revealing sensitive information, clicking malicious links, or opening malicious files1. These attacks can cause serious damage to the organization, such as financial loss, data breach, reputation harm, or legal liability1. Therefore, it is essential to address the human factors of social engineering risk, which are the psychological and emotional vulnerabilities that make people susceptible to these attacks, such as curiosity, greed, fear, urgency, or trust2. By mandating annual security awareness training, the organization can raise the level of knowledge and awareness among the employees about the common types, techniques, and indicators of social engineering attacks, as well as the best practices and policies to avoid them2. Security awareness training can also help to foster a culture of security and responsibility among the employees, and to reinforce their role and accountability in protecting the organization's assets and interests2. The other options are not as effective as mandating annual security awareness training, as they do not address the human factors of social engineering risk directly. Distributing the social media information security policy to staff may help to inform them about the rules and expectations for using social media platforms, but it does not ensure that they understand or follow them. Restricting access to social media may help to reduce the exposure to potential social engineering attacks, but it does not prevent them from occurring through other channels or mediums. Mandating security requirements be included in employee contracts may help to enforce compliance and deter violations, but it does not prevent them from happening due to ignorance or negligence.
