Canadian Health Information Management Association Practice Exam

Which of the following is NOT a category of people-oriented security threats?

1. Insiders who abuse their privileges

2. Insiders who make mistakes

3. Insiders who have privileges

4. Outsiders who steal devices

The correct answer is: Insiders who have privileges

The correct answer pertains to the classification of threats related to people-oriented security. Categories of people-oriented threats typically involve individuals who actively participate in security breaches, either through negligence, malicious intent, or misuse of their access rights. Insiders who abuse their privileges and insiders who make mistakes both fit into this category as they refer to people within an organization who can either intentionally misuse their access or inadvertently cause harm due to lack of attention or knowledge. Outsiders who steal devices also pose a people-oriented threat because they directly involve individuals infringing upon security by taking physical items. However, the option regarding insiders who have privileges is not a category of threat in itself; it simply describes individuals with access rights without indicating whether their behavior is problematic. This distinction highlights that merely having privileges does not contribute to the classification of a threat unless those privileges are abused or acted upon in a harmful manner. Therefore, it stands apart from the other examples of active threats and is why this choice is the correct answer.