During the security review of organizational servers, it was found that a file server containing confidential
human resources (HR) data was accessible to all user IDs. As a FIRST step, the security manager should:A. copy sample files as evidence.
B.
remove access privileges to the folder containing the data.
C.
report this situation to the data owner.
D.
train the HR team on properly controlling file permissions.
Explanation:
The data owner should be notified prior to any action being taken. Copying sample files as evidence is not advisable since it breaches confidentiality requirements on the file. Removing access privileges to the folder containing the data should be done by the data owner or by the security manager in consultation with the data owner, however, this would be done only after formally reporting the incident. Training the human resources
(MR) team on properly controlling file permissions is the method to prevent such incidents in the future, but should take place once the incident reporting and investigation activities are completed.