Section: INFORMATION SECURITY PROGRAM DEVELOPMENT

Explanation
Source code review is the best way to find and remove an application backdoor. Application backdoors can be almost impossible to identify' using a black box pen test or a security audit. A vulnerability scan will only find
"known" vulnerability patterns and will therefore not find a programmer's application backdoor.

Explanation/Reference:
Explanation:
Asserting that the condition is a true security incident is the necessary first step in determining the correct response. The containment stage would follow. Notifying senior management and law enforcement could be part of the incident response process that takes place after confirming an incident.

Section: INFORMATION RISK MANAGEMENT
Explanation:
When the cost of control is more than the cost of the risk, the risk should be accepted. Transferring, treating or terminating the risk is of limited benefit if the cost of that control is more than the cost of the risk itself.