← WA Computer Science ATAR Unit 2

Cyber security incident

An event that actually or potentially compromises the confidentiality, integrity or availability of data or systems, such as a data breach or a malware infection.

Part of: WA Computer Science ATAR Year 11 — Cyber Security — Module 12

Understanding Cyber security incident in WA Computer Science ATAR Unit 2

What it does: The code logs an incident whenever an event threatens confidentiality, integrity or availability, even if no harm has happened yet. An incident covers any actual or potential compromise of the CIA triad, not just financial loss. The incident begins when the compromise occurs or is likely, not when the attacker is paid. Unauthorised access to data compromises confidentiality, so it is a data breach incident. The definition includes events that potentially compromise CIA, so a suspected compromise can be treated as an incident. Data or systems that cannot be accessed when needed means availability is lost. A malware infection is harmful software running on a device, which compromises the CIA properties. Choosing a strong password is a protective action.

Common mistakes: Python lists have no add() method, so this raises an error. Use hit.append("integrity") to record the affected security property. An if statement must end with a colon. The line should be: if breached and records > 0:.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Cyber security incident to a class →

This module's key terms are also in a printable crossword (Modules 125–266) and word search (Modules 28–266).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which best describes a cyber security incident?
An event that actually or potentially compromises confidentiality, integrity or availabilityOnly an event where money is stolen from a bank account
Matches
if data_stolen: incident = False
↓
Stolen data is a breach, which is an incident because confidentiality is compromised. It should be set to True.
Applying
Meanings
Term
cyber security incident
Meaning
An event that actually or potentially compromises the confidentiality, integrity or availability of data or systems, such as a data breach or a malware infection.
Practice
IF event affects confidentiality OR integrity OR availability THEN
Testing
Gaps
if breach malware:
Check Answer
Spots
3if "malware" in incident:
4 hit.add("integrity")

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Golden Eagle' badge — High Flyer, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which best describes a cyber security incident?
A. An event that actually or potentially compromises confidentiality, integrity or availability ✓
B. Only an event where money is stolen from a bank account
An incident covers any actual or potential compromise of the CIA triad, not just financial loss.
2. A student's laptop is found running ransomware that locks their files. Is this a cyber security incident?
A. No, it only counts once the ransom has been paid
B. Yes, a malware infection compromises availability and possibly other CIA properties ✓
The incident begins when the compromise occurs or is likely, not when the attacker is paid.
3. An attacker downloads a school's student records without permission. This is an example of a:
A. Routine software update
B. Data breach, which is a type of incident ✓
Unauthorised access to data compromises confidentiality, so it is a data breach incident.
4. Which statement about incidents is correct?
A. An incident can be potential, where a compromise might happen but has not yet been confirmed ✓
B. An incident only exists once data has definitely been stolen
The definition includes events that potentially compromise CIA, so a suspected compromise can be treated as an incident.
5. Which CIA property is mainly compromised when malware deletes a company's database so staff cannot use it?
A. Availability ✓
B. Confidentiality
Data or systems that cannot be accessed when needed means availability is lost.

Match the Pairs

incident = breach → A data breach is an incident where confidential data is accessed or disclosed by someone who should not see it
incident = malware_infection → A malware infection is an incident where harmful software runs on a system and may damage data or stop it working
An incident can be only a potential compromise: a threat to CIA that has not yet caused harm still counts → if event.threatens(CIA): log_incident()
An incident is declared when an event compromises confidentiality, integrity or availability → if event.affects("C", "I", "A"): incident = True
if data_stolen: incident = False → Stolen data is a breach, which is an incident because confidentiality is compromised. It should be set to True.
if malware_found: incident = False → A malware infection can harm integrity and availability, so it is an incident. It should be set to True.

Key Term

cyber security incident
An event that actually or potentially compromises the confidentiality, integrity or availability of data or systems, such as a data breach or a malware infection.

Fill in the Blanks

1. if breach or malware: incident = True
Hint: Type the logical operator so that either a breach or a malware infection is enough to count as an incident.
2. if breach: print("Incident")
Hint: Type the built-in function that displays a message on the screen.
3. incident = True if incident: isolate()
Hint: Type the name of the variable that was set on the first line.
4. malware = True if malware: print("Incident")
Hint: Type the Boolean value that shows a malware infection was detected.
5. def check(c, i, a): return c or i or a
Hint: Type the keyword that sends the result back when the function is called.

Spot the Error

Question 1
A incident = "malware infection"
B hit = []
C if "malware" in incident:
D hit.add("integrity")
E print(hit)
Line D — Python lists have no add() method, so this raises an error. Use hit.append("integrity") to record the affected security property.
Question 2
A breached = True
B records = 500
C if breached and records > 0
D print("Incident declared")
Line C — An if statement must end with a colon. The line should be: if breached and records > 0:
Question 3
A bad = ["breach", "malware"]
B def is_incident(event):
C return event in bad
D print(is_incident(breach))
Line D — breach has no quotes, so Python treats it as an undefined variable. It must be the string "breach" to match the list.
Question 4
A incident_type == "data breach"
B loss = "confidentiality"
C print(incident_type, loss)
Line A — == compares values and does not store one, so incident_type is never created. Use = to assign the value.
Question 5
A users = 40
B infected = "12"
C rate = infected / users * 100
D print(rate)
Line B — The quotes make 12 a string, and a string cannot be divided by a number. It should be infected = 12.

Student with a class code? Join your class →