4.2 Cyber security incident report

What is the first step in documenting a cyber security incident?

• Classify the severity of the incident

• Provide a detailed description of the incident

• Identify the specific systems targeted

• Assign a descriptive title along with the date and time it occurred

How should the target of the incident be identified?

• By the impact of the incident

• By the specific systems, networks, or data targeted

• By the cost of the incident

• By the type of attacker

What determines the incident category?

• The techniques used by the attacker

• The financial cost of the incident

• The severity based on its impact on operations, data, and security

• The type of attacker

What is crucial to include in the description of the incident?

• Future management strategies

• Responses needed to mitigate the incident

• How it was discovered and its initial impact

• The cost of the incident

How should the type of attacker(s) be determined?

• Based on available evidence and analysis

• By the responses needed

• By the impact of the incident

• By the cost of the incident

What should the purpose of the incident identify?

• The future management strategies

• The capability of the attacker(s)

• The primary objective or motive behind the incident

• The financial losses incurred

Which aspect assesses the sophistication and expertise of the attacker(s)?

• The capability of the attacker(s)

• The impact of the incident

• The type of attacker(s)

• The techniques used by the attacker(s)

What is evaluated to understand the impact of the incident?

• The type of attacker(s)

• The incident's effect on business operations, data integrity, and recovery efforts

• The cost of the incident

• The techniques used by the attacker(s)

What does the cost of the incident include?

• Financial costs associated with response and mitigation

• The capability of the attacker(s)

• The impact of the incident on business operations

• The techniques used by the attacker(s)

What should future management strategies focus on?

• Evaluating the impact of the incident

• Identifying the type of attacker(s)

• Preventing, detecting, and responding to similar incidents

• Estimating the financial costs