[Introduction to Incident Handling and Response] Which of the following is not a countermeasure to eradicate inappropriate usage incidents?

Inappropriate usage incidents involve the violation of an organization's acceptable use policies. Countermeasures aim to prevent, detect, and deter such actions. Logging user activity (B), implementing network security controls like firewalls and IDS/IPS (C), and securing sensitive data with strict access controls (D) are all fundamental and effective countermeasures. Conversely, avoiding VPNs and other secure channels is counterproductive to security. These technologies are essential for protecting data confidentiality and integrity in transit. Deliberately avoiding them would weaken the security posture and increase the risk of data breaches and other incidents, making it an anti-pattern, not a countermeasure.

B. Register the user activity logs and keep monitoring them regularly: This is a key detective and deterrent control. It helps identify policy violations and discourages users from engaging in inappropriate behavior.
C. Install firewall and IDS/IPS to block services that violate the organization’s policy: These are preventative controls that enforce policy at the network level by blocking access to unauthorized services, applications, and websites.
D. Always store the sensitive data in far located servers and restrict its access: This describes data protection and access control measures (like the principle of least privilege), which are critical for preventing unauthorized data access and misuse.

1. NIST Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide. Section 2.3.1

"Incident Categories

" explicitly lists "Inappropriate Usage" as a major incident category. Section 3.1

"Preparation - Preventing Incidents

" recommends practices such as network security (related to option C)

host security

and user awareness

which are all contrary to the advice in option A. The guide implicitly supports secure communications as a baseline security practice.

2. NIST Special Publication 800-53 Rev. 5

Security and Privacy Controls for Information Systems and Organizations. The control families AC (Access Control)

AU (Audit and Accountability)

and SC (System and Communications Protection) directly map to the valid countermeasures. Specifically

SC-8 "Transmission Confidentiality and Integrity" recommends encryption (e.g.

via VPNs) to protect data

directly contradicting option A. Options B

C

and D are supported by controls AU-2

SC-7

and AC-3

respectively.

3. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM

18(7)

387-408. This foundational paper outlines security principles. The principle of "Least Privilege" supports option D. The concept of "Complete Mediation" (checking every access) supports options B and C. The paper advocates for protective measures

not their avoidance. (DOI: https://doi.org/10.1145/361011.361062

Section I.A. Principles of Design).