A company is investigating a data compromise where data exfiltration occurred. Prior to the investigation,
the supervisor terminates an employee as a result of the suspected data loss. During the investigation,
the supervisor is absent for the interview, and little evidence can be provided form the role-based
authentication system in use by the company. The situation can be identified for future mitigation as
which of the following?
A.
Job rotation
B.
Log failure
C.
Lack of training
D.
Insider threat
So we have a breach and before the investigation, we fire the employee. We fail to interview the supervisor. There is little evidence. So the problem is our lack of logging. No, this is a failure to train the employees, the supervisor, the sys admin. For all we know, the supervisor pocketed the information and sold it to the competitor and fired the employee for no reason but since no one knew to actually interview him/her, we give up. This is a lack of training issue.
B is the correct answer. Log analysis is crucial to identifying problems that occur related to security.