Security Incident

Who is responsible for identifying and reporting Security Incidents?

• IT-Security

• Guard

• Everybody

• DGIT employees

While responding to security incidents and problems, at which step does "Stop the bleeding" occur?

• Eradication

• Containment

• Lessons learned

• Recovery

True or false? Only confirmed personal data breach is reported to GDPO.

• True

• False

What occurs in the recovery phase?

• Resume the system to production and normal operations

• Stop the bleeding

• Root cause analysis and restore the system

• improve our defense against same threats

External cyber security support is always involved in security problem handling.

• True

• False

Which process step does not include communication to stakeholders？

• Containment

• Eradication

• Lessons learned

• None above

What is not performed during the Eradication phase?

• Root cause analysis

• Implement workaround or fix

• Restore systems in contained environment

• Resume system back to production

What is not performed during the Lessons Learned phase?

• Improve our systems

• Root Cause analysis

• Implement security monitoring

• Share knowledge

What is wrong about Ransomware?

• Spreads automatically to other computers,

• Impacted computers must be isolated immediately

• Spreads through e-mail

• Causes no outages

What are common attack types?

• Ransomware

• Phishing

• Impersonation

• Advanced Persistent Threat