LO4.2 Flashcards
What are the twelve components of a typical cyber security incident report?
Title and Date
Target of incident
Incident category
Description of incident
Type of attacker
Purpose of incident
Technique(s) used by attacker(s)
Capability of attacker(s)
Impact of incident
Cost of incident
Responses needed
Future management
Why is the date important for a cyber security incident report?
So it can be cross-referenced with other activity such as updates
What could be noted for the target of the incident?
Whether the incident was targeted upon the organisation, a particular department or just an individual or if the target was upon hardware, software, information
What are the four incident categories?
Critical
Significant
Minor
Negligible
What are three examples of what may be considered for the description of the incident?
What specific problem did it create
How is discovered
What type of incident it was
What are three examples of what could be considered for the type of attacker?
Was it internal
External
One person or a group
What are three examples of what could be considered for the purpose of incident?
Was it for financial gain
Political advantage
Destruction of reputation
What are three examples of what could be considered for the impact of the incident?
Business
Data
Recovery time
What are the two main examples of what could be considered for the cost of the incident?
Financial
Reputation
What are three examples of what could be considered for future management?
Review of incident
Analysis to evaluate trends
Updates of key information and procedures
