Cyber security incident

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which best describes a cyber security incident?

A An event that actually or potentially compromises the confidentiality, integrity or availability of systems or data

B A weakness in code that has not yet been noticed by anyone

2. A developer finds that a login page does not limit password attempts, but nobody has abused it. What is this?

A A cyber security incident

B A vulnerability

3. An attacker uses a weakness in a web form to download customer records. What is this?

A Only a vulnerability

B A cyber security incident

4. Which is an example of a cyber security incident in software development?

A Ransomware encrypts the files on the team's build server

B A developer writes a function with a long name

5. Which statement about a cyber security incident is correct?

A It can be a potential compromise, such as a suspected attempt to access a repository

B It only counts once data has definitely been stolen

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1ALERT: 500 failed logins from one IP in 2 min		AIncidents are not limited to stolen data. Any event that compromises integrity or availability, such as ransomware or a denial-of-service attack, or that could compromise any of the three, is also an incident.
2git log: API key pushed to public repo		Bdetect -> contain -> eradicate -> recover -> review
3A vulnerability is only a weakness; it becomes an incident when something actually happens		CA cyber security incident in progress: a suspected brute-force attack that could compromise confidentiality
4An incident moves through phases: detect, contain, eradicate, recover, then review		Dunpatched library = vulnerability; attacker exploits it = incident
5incident = missing input validation in a login form		EA cyber security incident: a secret is exposed, so confidentiality of systems or data is potentially compromised
6Only a data theft counts as a cyber security incident		FThis confuses a vulnerability with an incident. Missing validation is a weakness, and it becomes an incident only when an event such as a SQL injection attack happens.

Definitions

cyber security incident

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF failedLogins > 100 THEN SEND ________ TO securityTeam END IF

// An unpatched library is a _____________ // Stolen customer data is an incident

IF dataLeaked THEN affected = _______________ END IF

detect(alert) _______(affectedServer) recover(backups)

IF ransomwareLocksServer THEN affected = ____________ END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A vuln = "server was hacked"

B incident = "ransomware attack"

C print(vuln, "is a weakness")

D print(incident, "is an event")

Question 2

A phases = []

B phases.add("detect")

C phases.append("contain")

D phases.append("recover")

Question 3

A severity = 8

B contained = False

C if severity > 7:

D print(Escalate incident)

Question 4

A failed_logins = 52

B limit = 10

C if failed_logins > limit

D print("Possible incident")

Question 5

A def report_incident(system)

B time = "09:15"

C print(system, time)

Answer Key

Cyber security incident

Section A: Quick Questions

A — An event that actually or potentially compromises the confidentiality, integrity or availability of systems or data

B — A vulnerability

B — A cyber security incident

A — Ransomware encrypts the files on the team's build server

A — It can be a potential compromise, such as a suspected attempt to access a repository

Section B: Match the Pairs

ALERT: 500 failed logins from one IP in 2 min → A cyber security incident in progress: a suspected brute-force attack that could compromise confidentiality

git log: API key pushed to public repo → A cyber security incident: a secret is exposed, so confidentiality of systems or data is potentially compromised

A vulnerability is only a weakness; it becomes an incident when something actually happens → unpatched library = vulnerability; attacker exploits it = incident

An incident moves through phases: detect, contain, eradicate, recover, then review → detect -> contain -> eradicate -> recover -> review

incident = missing input validation in a login form → This confuses a vulnerability with an incident. Missing validation is a weakness, and it becomes an incident only when an event such as a SQL injection attack happens.

Only a data theft counts as a cyber security incident → Incidents are not limited to stolen data. Any event that compromises integrity or availability, such as ransomware or a denial-of-service attack, or that could compromise any of the three, is also an incident.

Section C: Definitions

cyber security incident — An event that actually or potentially compromises the confidentiality, integrity or availability of an organisation's systems or data, such as a breach or malware infection.

Section D: Fill in the Blanks

IF failedLogins > 100 THEN
SEND incident TO securityTeam
END IF

// An unpatched library is a vulnerability
// Stolen customer data is an incident

IF dataLeaked THEN
affected = confidentiality
END IF

detect(alert)
contain(affectedServer)
recover(backups)

IF ransomwareLocksServer THEN
affected = availability
END IF

Section E: Spot the Error

A — A vulnerability is a weakness, not an event. 'Server was hacked' is an incident. The weakness should be something like "unpatched server".

B — Python lists do not have an add() method. Use phases.append("detect") to add the detect phase.

D — The message is text, so it must be in quotes. It should be print("Escalate incident").

C — An if statement must end with a colon. It should be if failed_logins > limit:

A — A function definition must end with a colon. It should be def report_incident(system):