Question

A financial services firm has identified that phishing attacks are the leading cause of credential compromise. The risk owner has decided to mitigate this risk and asks the risk practitioner to recommend the most effective control approach given that no single control fully eliminates the threat. Which recommendation should the practitioner provide?

Accepted Answer

Implement a layered set of complementary controls addressing prevention, detection, and user awareness

Answer

Deploy the single strongest email-filtering technology available and rely on it exclusively

Answer

Purchase cyber insurance to cover losses arising from successful phishing attacks

Answer

Accept the residual risk since phishing cannot be completely eliminated by any control