Justifying information security projects
A) is not needed because it is well-known that preventing network security problems is less labor intensive than cleaning up virus infections.
B) is not done because ROI calculators are not available.
C) should focus on defending against external threats such as hackers and malware.
D) should be done because employee security training is usually poorly done.

Question

Quizplus · Accepted Answer

Justifying information security projects is important because employee security training is often poorly done, leading to higher risk of security incidents. By explaining the potential impact of breaches and the benefits of strong security measures, organizations can effectively justify the cost of implementing security solutions. It is also important to focus on the ROI of security projects and the potential cost savings from preventing security incidents. Defending against external threats is important, but internal threats (such as employee errors) should also be addressed through proper training and policies.

Justifying Information Security Projects