The threat modeling identifies a man-in-the-middle (MITM) exposure. Which countermeasure should the information system security officer (ISSO) select to mitigate the risk of a protected Health…

The correct answer is B. Anonymization. The specific risk here is a PHI data leak resulting from a MITM attack. Anonymization removes or replaces personally identifiable and health-related information so that even if an attacker intercepts the data, it cannot be linked to any individual - meaning no PHI leak occurs…

Privacy and Security in Healthcare

Question

The threat modeling identifies a man-in-the-middle (MITM) exposure. Which countermeasure should the information system security officer (ISSO) select to mitigate the risk of a protected Health information (PHI) data leak?

Options

AAuditing
BAnonymization
CPrivacy monitoring
DData retention

How the community answered

(51 responses)

A
16% (8)
B
71% (36)
C
4% (2)
D
10% (5)

Explanation

The specific risk here is a PHI data leak resulting from a MITM attack. Anonymization removes or replaces personally identifiable and health-related information so that even if an attacker intercepts the data, it cannot be linked to any individual - meaning no PHI leak occurs. This is a data-centric countermeasure that neutralizes the consequence of interception. The other options do not directly prevent the PHI from being exposed: auditing detects incidents after the fact; privacy monitoring is a detective control; and data retention policies govern how long data is kept, not how it is protected in transit. Anonymization ensures that intercepted data has no PHI value to the attacker.

Topics

#Man-in-the-Middle (MITM)#PHI data leak#Anonymization#Risk Mitigation

Community Discussion

No community discussion yet for this question.

Full HCISPP Practice