The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze. Which step should be taken at this stage?
A) Determine the assets to which the attacker has access
B) Identify assets the attacker handled or acquired
C) Change access controls to high risk assets in the enterprise
D) Identify movement of the attacker in the enterprise

Question

Quizplus · Accepted Answer

The immediate step is to identify the movement of the attacker in the enterprise to understand the extent of the breach and potential risks.

The Physical Security Department Received a Report That an Unauthorized