A Chief Security Officer (CSO) is reviewing the organization's incident response report from a recent incident. The details of the event indicate: A user received a phishing email that appeared to be a report from the organization's CRM tool.
The user attempted to access the CRM tool via a fraudulent web page but was unable to access the tool
The user, unaware of the compromised account, did not report the incident and continued to use the CRM tool with the original credentials
Several weeks later, the user reported anomalous activity within the CRM tool
Following an investigation, it was determined the account was compromised and an attacker in another country had gained access to the
CRM tool
Following identification of corrupted data and successful recovery from the incident, a lessons learned activity was to be led by the CSO
Which of the following would MOST likely have allowed the user to more quickly identify the unauthorized use of credentials by the attacker?
Security awareness training
Last login verification
Log correlation
Time-of-check controls
Time-of-use controls
WAYF-based authentication