Exam CISA topic 1 question 153 discussion

Malware is most commonly introduced via file attachments in instant messaging. Blocking attachments directly prevents users from exchanging potentially harmful files, thus mitigating the malware risk effectively. This control allows users to still communicate via IM, preserving business functionality, but reduces the main malware attack vector. Why not the others? A. Blocking external IM traffic ➤ Reduces risk but may hinder legitimate business communications with external partners. C. Allowing only corporate IM solutions ➤ Helps control and monitor traffic but doesn’t eliminate malware risk if attachments are allowed. D. Encrypting IM traffic ➤ Protects confidentiality but does not prevent malware infection.

this aligns with the CISA CRM recommendation, which gives strong weight to blocking or restricting IM traffic as a preventive control. Refer to 5.9.5 Instant Messaging, figure 5.22 from the CISA CRM.

This is the BEST control. Malware is often spread through malicious attachments.1 Blocking attachments significantly reduces the risk of infection

Blocking IM attachments

Allowing only corporate IM solutions is the best control to mitigate the malware risk associated with IM systems because it prevents unauthorized or malicious IM applications from accessing the network and infecting the system with malware.

also agree with C. we only scope internal users. at least its controlled within the enterprise only.

The answer is A. Refer to 5.9.5 Instant Messaging, figure 5.22 from the CISA CRM> It clearly states that : Ensure that antivirus and anti-malware controls are installed on allsystems and updated daily. • Block IM traffic. • Only allow an enclosed corporate IM solution

Blocking attachments in IM

The best control to mitigate the malware risk associated with an instant messaging (IM) system is blocking attachments in IM. Malware can be spread through file attachments in instant messages, so preventing the exchange of attachments in IM can help reduce the risk of malware infection.

Option B is the best control to mitigate the malware risk associated with an IM system because blocking attachments in IM can help to prevent the transmission of malware through the IM system. Malware is often transmitted through attachments, so blocking attachments can be an effective way to prevent the spread of malware. Option A may help to reduce the risk of malware, but it is not as effective as blocking attachments because malware can still be transmitted through other means. Option C may help to reduce the risk of malware, but it is not as effective as blocking attachments because malware can still be transmitted through other means. Option D may help to protect against the interception of IM traffic, but it does not address the risk of malware transmission.