Maria is a security administrator for a large bank. She is concerned about malware, particularly spyware that could compromise customer data. Which of the following would be the best approach for her to mitigate the threat of spyware?

Control diversity means utilizing different controls to mitigate the same threat. For malware, the use of technical controls, such as antimalware, is critical. But it is also important to have administrative controls, such as good policies, and to make sure that employees are properly trained. Therefore, for this question a combination of policies, training, and tools is the best options.