MD2 To escalate or not to escalate: Prepare to escalate through security recognition

Question 1

Incident Classification Types:

Malware infection

Answer 1

Malware infection: Malicious software infiltrates an organization’s computers or network, disrupting systems and potentially compromising sensitive data.

Malware infections can cause a system’s network to run an unusually low speeds. Attackers can even prevent an organization from viewing critical data, unless the organization pays the attacker a ransom to unlock the data. This incident type is especially impactful to an organization because of the amount of sensitive data stored on an organization’s network and computers. Escalating malware infections is an important aspect of protecting the organization that you work for.

Question 2

Incident Classification Types:

Unauthorized access

Answer 2

Unauthorized access: An individual gains access to a system or application without permission, potentially compromising data or disrupting operations.

These attacks are often used to help attackers gain unauthorized access to an organization’s systems or applications.
All unauthorized access incidents are important to escalate. However, the urgency of that escalation depends on how critical that system is to the organization’s business operations.

Question 3

Incident Classification Types:

Improper usage:

Answer 3

An employee violates the organization’s acceptable use policies, either intentionally or unintentionally, potentially compromising data or disrupting operations.

This one can be a bit complicated. There are instances when improper usage is unintentional. For an example, an employee may attempt to access software licenses for personal use or even use a company’s system to access a friend’s or coworker’s data. Maybe the employee wasn’t aware of the policy they were violating, or maybe the policy wasn’t properly defined and communicated to employees.

Always escalate to a supervisor