← VCE Software Development U4O2

Cyber security incident

An event that actually or potentially compromises the confidentiality, integrity or availability of an organisation's systems or data, such as a breach or malware infection.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 20, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 16

Understanding Cyber security incident in VCE Software Development U4O2

What it does: The unpatched library is the weakness. The attacker exploiting it is the event that compromises the system, so that is the incident. This sequence shows the phases of handling an incident from first noticing it through to learning lessons afterwards. Ransomware makes data unavailable, so it compromises availability. A long function name is only a style choice. Incidents include actual and potential compromises, so suspected or attempted events still need to be treated as incidents. The secret is exposed, so confidentiality is potentially compromised. It is an incident even without a confirmed attacker. An organisation must first detect and identify an incident before it can contain it and limit the damage.

Common mistakes: A vulnerability is a weakness, not an event. 'Server was hacked' is an incident. The weakness should be something like "unpatched server". Python lists do not have an add() method. Use phases.append("detect") to add the detect phase.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Cyber security incident to a class →

This module's key terms are also in a printable crossword (Modules 1–22) and word search (Modules 1–47).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which best describes a cyber security incident?
An event that actually or potentially compromises the confidentiality, integrity or availability of systems or dataA weakness in code that has not yet been noticed by anyone
Matches
incident = missing input validation in a login form
↓
This confuses a vulnerability with an incident. Missing validation is a weakness, and it becomes an incident only when an event such as a SQL injection attack happens.
Applying
Meanings
Term
cyber security incident
Meaning
An event that actually or potentially compromises the confidentiality, integrity or availability of an organisation's systems or data, such as a breach or malware infection.
Practice
event ← "ransomware on build server"
Testing
Gaps
SEND TO securityTeam
Check Answer
Spots
1vuln = "server was hacked"
2incident = "ransomware attack"

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Golden Eagle' badge — High Flyer, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which best describes a cyber security incident?
A. An event that actually or potentially compromises the confidentiality, integrity or availability of systems or data ✓
B. A weakness in code that has not yet been noticed by anyone
An incident is an event. A weakness in code is a vulnerability, which is different.
2. A developer finds that a login page does not limit password attempts, but nobody has abused it. What is this?
A. A cyber security incident
B. A vulnerability ✓
A vulnerability is a weakness. No event has compromised the CIA triad yet, so it is not an incident.
3. An attacker uses a weakness in a web form to download customer records. What is this?
A. Only a vulnerability
B. A cyber security incident ✓
The weakness is the vulnerability, but the exploitation that exposes data is the incident, because confidentiality was compromised.
4. Which is an example of a cyber security incident in software development?
A. Ransomware encrypts the files on the team's build server ✓
B. A developer writes a function with a long name
Ransomware makes data unavailable, so it compromises availability. A long function name is only a style choice.
5. Which statement about a cyber security incident is correct?
A. It can be a potential compromise, such as a suspected attempt to access a repository ✓
B. It only counts once data has definitely been stolen
Incidents include actual and potential compromises, so suspected or attempted events still need to be treated as incidents.

Match the Pairs

ALERT: 500 failed logins from one IP in 2 min → A cyber security incident in progress: a suspected brute-force attack that could compromise confidentiality
git log: API key pushed to public repo → A cyber security incident: a secret is exposed, so confidentiality of systems or data is potentially compromised
A vulnerability is only a weakness; it becomes an incident when something actually happens → unpatched library = vulnerability; attacker exploits it = incident
An incident moves through phases: detect, contain, eradicate, recover, then review → detect -> contain -> eradicate -> recover -> review
incident = missing input validation in a login form → This confuses a vulnerability with an incident. Missing validation is a weakness, and it becomes an incident only when an event such as a SQL injection attack happens.
Only a data theft counts as a cyber security incident → Incidents are not limited to stolen data. Any event that compromises integrity or availability, such as ransomware or a denial-of-service attack, or that could compromise any of the three, is also an incident.

Key Term

cyber security incident
An event that actually or potentially compromises the confidentiality, integrity or availability of an organisation's systems or data, such as a breach or malware infection.

Fill in the Blanks

1. IF failedLogins > 100 THEN SEND incident TO securityTeam END IF
Hint: Type the term for an event that actually or potentially compromises confidentiality, integrity or availability.
2. // An unpatched library is a vulnerability // Stolen customer data is an incident
Hint: Type the term for a weakness that has not yet been exploited, as opposed to an incident.
3. IF dataLeaked THEN affected = confidentiality END IF
Hint: Type the security property compromised when data is exposed to people who should not see it.
4. detect(alert) contain(affectedServer) recover(backups)
Hint: Type the function name for the incident phase that stops the problem spreading after it is detected.
5. IF ransomwareLocksServer THEN affected = availability END IF
Hint: Type the security property compromised when authorised users can no longer access a system.

Spot the Error

Question 1
A vuln = "server was hacked"
B incident = "ransomware attack"
C print(vuln, "is a weakness")
D print(incident, "is an event")
Line A — A vulnerability is a weakness, not an event. 'Server was hacked' is an incident. The weakness should be something like "unpatched server".
Question 2
A phases = []
B phases.add("detect")
C phases.append("contain")
D phases.append("recover")
Line B — Python lists do not have an add() method. Use phases.append("detect") to add the detect phase.
Question 3
A severity = 8
B contained = False
C if severity > 7:
D print(Escalate incident)
Line D — The message is text, so it must be in quotes. It should be print("Escalate incident").
Question 4
A failed_logins = 52
B limit = 10
C if failed_logins > limit
D print("Possible incident")
Line C — An if statement must end with a colon. It should be if failed_logins > limit:
Question 5
A def report_incident(system)
B time = "09:15"
C print(system, time)
Line A — A function definition must end with a colon. It should be def report_incident(system):

Student with a class code? Join your class →