Which risk management strategy will ensure that data stored on an Enterprise Resource Planning (ERP) system is secure from exploitation in the event…

The question asks for a strategy to secure data from exploitation in the event a data breach has already occurred. Data encryption is the only control listed that protects the confidentiality of the data itself. If the data stored on the ERP system is encrypted at rest, an attacker who successfully breaches the system and exfiltrates the data files will only possess unreadable ciphertext. Without the corresponding decryption keys, the stolen data is rendered useless and cannot be exploited, thus directly mitigating the risk of exposure and misuse post-breach. This strategy addresses the confidentiality of the data after preventive controls have failed.

B. A firewall is a preventive control designed to block unauthorized access. In the scenario where a breach has already occurred, the firewall has been bypassed and offers no protection for the exfiltrated data.

C. Backups and disaster recovery are focused on data availability and business continuity. They allow for restoration of services but do not protect the confidentiality of data that has already been stolen.

D. Disabling printing is a specific Data Loss Prevention (DLP) control for one physical exfiltration vector. It does not prevent digital exfiltration over the network or protect the data once it is stolen.

---

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (Special Publication 800-53, Revision 5).

Reference: Control SC-28, "Protection of Information at Rest," Page 237.

Excerpt/Rationale: This control explicitly states, "The organization protects the confidentiality and integrity of...information at rest." The discussion section for this control identifies cryptographic mechanisms (encryption) as the primary method for providing confidentiality for data on storage devices. This directly supports encryption as the correct strategy to protect data confidentiality post-breach.

2. Saltzer, J. H., & Kaashoek, M. F. (2009). Principles of Computer System Design: An Introduction. Morgan Kaufmann.

Reference: Chapter 9, "Security and Protection," Section 9.2.1 "Confidentiality."

Rationale: This foundational text, often used in university curricula like MIT's, explains that confidentiality is the prevention of unauthorized disclosure of information. It identifies encryption as the principal mechanism for enforcing confidentiality on stored data, ensuring that even if an attacker gains access to the storage medium, they cannot read the information.

3. Oracle. (2023). Oracle Fusion Applications Security Guide.

Reference: Chapter 3, "Securing Oracle Fusion Applications," Section: "Data Encryption and Data Masking."

Rationale: As official vendor documentation for a major ERP system, this guide outlines security best practices. It specifies the use of Transparent Data Encryption (TDE) to encrypt data at rest within the database. This ensures that "data files are not readable by an unauthorized user," directly addressing the scenario in the question.