MENU
A bank employee is found to be exfiltration sensitive information by uploading it via email. Which of the following security measures would be MOST effective in detecting this type of insider threat?
Data Loss Prevention (DLP) systems are specifically designed to detect and prevent unauthorized data transfers. In the context of an insider threat, where a bank employee attempts to exfiltrate sensitive information via email, DLP solutions are most effective because they:
Monitor Data in Motion: DLP can inspect outgoing emails for sensitive content based on pre-defined rules and policies.
Content Inspection and Filtering: It examines email attachments and the body of the message for patterns that match sensitive data (like financial records or PII).
Real-Time Alerts: Generates alerts or blocks the transfer when sensitive data is detected.
Granular Policies: Allows customization to restrict specific types of data transfers, including via email.
Other options analysis:
B . Intrusion detection system (IDS): IDS monitors network traffic for signs of compromise but is not designed to inspect email content or detect data exfiltration specifically.
C . Network segmentation: Reduces the risk of lateral movement but does not directly monitor or prevent data exfiltration through email.
D . Security information and event management (SIEM): SIEM can correlate events and detect anomalies but lacks the real-time data inspection that DLP offers.
CCOA Official Review Manual, 1st Edition Reference:
Chapter 5: Insider Threats and Mitigation: Discusses how DLP tools are essential for detecting data exfiltration.
Chapter 6: Threat Intelligence and Analysis: Covers data loss scenarios and the role of DLP.
Chapter 8: Incident Detection and Response: Explains the use of DLP for detecting insider threats.