To reduce the threat of spear phishing, which of the following is the MOST critical security control to implement?

Question

Options

• ASecurity awareness and training
• BFirewall
• CData loss prevention
• DAntivirus

• A
  76% (39)
• B
  8% (4)
• C
  14% (7)
• D
  2% (1)

Explanation

Security awareness and training (A) is the most critical control because spear phishing is a social engineering attack that specifically targets human behavior - it crafts convincing, personalized messages to trick individuals into clicking links or divulging credentials. No technical control can fully compensate for a user who doesn't recognize and report a convincing phishing attempt.

Why the distractors fall short:

• Firewall (B): Filters network traffic by port/protocol but cannot inspect email content for social engineering tactics or block legitimate-looking phishing links.
• Data loss prevention (C): Focuses on preventing sensitive data from leaving the organization - it addresses the outcome of a successful breach, not the phishing attempt itself.
• Antivirus (D): Detects known malicious files/signatures, but spear phishing often uses legitimate-looking links, credential harvesting sites, or zero-day payloads that evade signature-based detection.

Memory tip: Spear phishing targets people, so the best defense also targets people - trained humans are your last line of defense when every technical control has been bypassed. Think "social attack → social defense."

No community discussion yet for this question.