Identify common insider threats and relevant TA mitigations.

• A. Malicious insiders and negligent users; mitigations include least privilege, continuous monitoring, attestation of actions, separation of duties, and strict access reviews
• B. External attackers and DDoS; use more routers
• C. Natural disasters; improve insurance
• D. Public relations issues; more newsletters

Answer: (A)

Protecting against threats that originate from inside the organization is the focus here. Insiders can be malicious, abusing their access, or negligent, inadvertently causing harm through carelessness. The mitigations listed align well with reducing this risk because they limit what insiders can do, keep a close eye on activities, and ensure accountability.

Least privilege minimizes potential damage by giving people only the access they truly need. Continuous monitoring helps detect unusual or unauthorized actions as they happen, enabling a rapid response. Attestation of actions provides verifiable evidence of what actions were performed and by whom, supporting accountability and making it harder to hide misuse. Separation of duties prevents a single insider from having enough authority to carry out fraud or major policy violations alone. Strict access reviews ensure that privileges stay aligned with current roles and are removed promptly when roles change or people depart.

Other options focus on external threats or unrelated issues—external attackers and DDoS belong to perimeter, not insider, concerns; natural disasters or PR problems don’t address insider risk with these controls.