Several business units have requested the ability to use collaborative web-based meeting places with third party vendors. Generally these require user registration, installation of client-based…

Question

Options

• ADisallow the use of web-based meetings as this could lead to vulnerable client-side components
• BHire an outside consultant firm to perform both a quantitative and a qualitative risk-based assessment.
• CAllow the use of web-based meetings, but put controls in place to ensure that the use of these meetings
• DEvaluate several meeting providers.

• A
  5% (3)
• B
  22% (12)
• C
  11% (6)
• D
  62% (34)

Explanation

Evaluating several meeting providers allows the organization to identify and select a vendor that meets both the business requirement (collaboration with third parties) and security requirements (safe handling of ActiveX/Java applets, desktop sharing). A formal evaluation process compares providers on security posture, compliance certifications, data handling practices, and risk profiles before granting access. Option A is overly restrictive and ignores the legitimate business need. Option B (hiring a consultant for a full risk assessment) is disproportionate for this type of decision and doesn't directly solve the selection problem. Option C is partially correct in spirit but is less precise than a proper vendor evaluation, which is the structured approach that should precede defining controls.

No community discussion yet for this question.