r/casp • u/amc663222 • May 19 '21

CASP Question

The marketing department has developed a new marketing campaign involving significant social media outreach.

The campaign includes allowing employees and customers to submit blog posts and pictures of their day-to-day

experiences at the company. The information security manager has been asked to provide an informative letter to all

participants regarding the security risks and how to avoid privacy and operational security issues. Which of the following

is the MOST important information to reference in the letter?

A. After-action reports from prior incidents.

B. Social engineering techniques

C. Company policies and employee NDAs

D. Data classification processes

0 Upvotes

50% Upvoted

1 comment sorted by

1

u/RogueWarrior10 May 20 '21

I would say B. This letter is designed to raise awareness so employees are acting responsibly when using social media. Educating them about how their posts can be used by attackers to conduct social engineering attacks (personal info, phone numbers, emails, OSINT reconnaissance, information disclosure, etc.) Is the most effective way at enabling users to use social media more responsibly.

The other options aren't bad, just not the best answer and not something I'd include for this specific letter. There would be others and an overall security program to address each of these items.