The most effective method of mitigating data theft from an active user workstation is to disable use of portable devices. Portable devices are the devices that can be easily connected to or disconnected from a workstation, such as USB drives, external hard drives, flash drives, or smartphones. Portable devices can pose a risk of data theft from an active user workstation, as they can be used to copy, transfer, or exfiltrate data from the workstation, either by malicious insiders or by unauthorized outsiders. By disabling use of portable devices, the data theft from an active user workstation can be prevented or reduced.
A. Implement full-disk encryption is not the most effective method of mitigating data theft from an active user workstation, but rather a method of mitigating data theft from a lost or stolen user workstation. Full-disk encryption is the process of transforming or encoding the entire data on a disk or a device into an unreadable or unintelligible form, using a secret key or algorithm. Full-disk encryption can protect the data from unauthorized access or disclosure if the disk or the device is lost or stolen, but it does not protect the data from unauthorized copying or transferring if the disk or the device is active and unlocked.
B. Enable multifactor authentication is not the most effective method of mitigating data theft from an active user workstation, but rather a method of mitigating unauthorized access or login to a user workstation. Multifactor authentication is the process of verifying the identity and the legitimacy of a user or a device by requiring two or more factors or methods of authentication, such as something the user knows (e.g., password, PIN, or security question), something the user has (e.g., token, card, or smartphone), or something the user is (e.g., fingerprint, face, or voice). Multifactor authentication can prevent or reduce unauthorized access or login to a user workstation, but it does not prevent or reduce data theft from an active user workstation, especially by malicious insiders who have legitimate access or login credentials.
C. Deploy file integrity checkers is not the most effective method of mitigating data theft from an active user workstation, but rather a method of detecting data tampering or corruption on a user workstation. File integrity checkers are the software tools or applications that monitor and verify the integrity or the authenticity of the files or the programs on a workstation, by using cryptographic techniques, such as hashing, digital signatures, or certificates. File integrity checkers can detect data tampering or corruption on a user workstation, but they cannot prevent or reduce data theft from an active user workstation, as they do not prevent or restrict data copying or transferring.
References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 6, page 330; Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 6, page 291
