위협 모델링은 MITM (Man-in-the-Middle) 노출을 식별합니다. 정보 시스템 보안 담당자 (ISSO)는 보호 된 건강 정보 (PHI) 데이터 유출의 위험을 완화하기 위해 어떤 대책을 선택해야 합니까?
정답: B
The countermeasure that the information system security officer (ISSO) should select to mitigate the risk of a protected health information (PHI) data leak due to a man-in-the-middle (MITM) exposure is anonymization. A MITM exposure is a type of network attack where an attacker intercepts, modifies, or relays the communication between two parties, such as a client and a server, without their knowledge or consent. A MITM exposure can compromise the confidentiality, integrity, and availability of the data and the network, and can lead to data theft, fraud, or sabotage. A PHI data leak is a type of data breach where the sensitive and personal information of patients or health care providers, such as medical records, diagnoses, treatments, or insurance details, are exposed or disclosed to unauthorized parties, such as hackers, competitors, or media. A PHI data leak can violate the privacy and security of the data and the individuals, and can result in legal or regulatory penalties, reputational damage, or financial losses.
Anonymization is a technique that removes or masks the identifying or personal information from the data, such as names, addresses, or social security numbers, and replaces them with pseudonyms, codes, or random values. Anonymization can prevent or reduce the risk of a PHI data leak due to a MITM exposure, as it makes the data untraceable and unlinkable to the individuals, and protects the data from being accessed or misused by unauthorized parties.
Auditing, privacy monitoring, and data retention are not countermeasures that the ISSO should select to mitigate the risk of a PHI data leak due to a MITM exposure, as they are either not effective or not relevant for preventing or reducing the data exposure or disclosure, or they may have other purposes or functions than data protection.
