CRISC Certified in Risk and Information Systems ControlRisk Response and ReportingHard
An organization has implemented a new data loss prevention (DLP) solution to monitor and block the exfiltration of sensitive data. As part of control monitoring, the risk manager reviews weekly reports showing a significant number of DLP alerts, but further investigation reveals that most of these are false positives or legitimate business activities. What conclusion should the risk manager draw regarding the DLP control's effectiveness and its impact on risk reporting?
- AThe DLP control is ineffective due to the high volume of false positives, which obscures actual threats and impacts accurate risk reporting.
- BThe DLP control is highly effective because it is generating many alerts, indicating active monitoring.
- CThe DLP control is moderately effective, but requires tuning to reduce false positives for more accurate risk reporting.
- DThe DLP control should be disabled to prevent alert fatigue, and alternative controls should be implemented.
Show answer & explanationAnswer & explanation
Correct answer: C. The DLP control is moderately effective, but requires tuning to reduce false positives for more accurate risk reporting.
A high volume of false positives means the control is detecting activity, but its accuracy is low, impacting its ability to effectively identify true risks and leading to 'alert fatigue'. It's not completely ineffective (as it's detecting *something*), but it needs tuning to improve its precision and reduce noise so that genuine threats can be identified and reported accurately.
Why the other options are wrong
- A. While false positives do obscure threats, calling it 'ineffective' might be too strong if it is catching some legitimate issues. 'Moderately effective' with a need for tuning is more precise.
- B. Many alerts, if mostly false positives, indicate poor accuracy, not necessarily high effectiveness in threat identification.
- D. Disabling the control is an extreme measure that would introduce unmanaged risk. Tuning is a more appropriate first step.
Control Effectiveness (Accuracy)
The degree to which a control achieves its intended objective, often measured by its ability to prevent, detect, or correct risks accurately and consistently.
- Involves precision (reducing false positives)
- Involves recall (not missing true positives)
- Impacts the reliability of risk reporting
Memory trick: Accuracy is Key: True P's, False N's, no noise!