Password policies reduce credential-disclosure opportunities, vulnerability assessments can identify weaknesses exposed through social-engineering tests, and data classification defines sensitivity and handling requirements that limit inappropriate disclosure. Data encryption protects the confidentiality of data but does not itself prevent a person from being deceived into disclosing information or performing an unsafe action. NIST guidance recognizes security testing and assessment, including social-engineering testing, as a means to improve security, and describes data classification as a basis for communicating data-handling rules.
Community Discussion