Cyber security incident

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which best describes a cyber security incident?

A An event that actually or potentially compromises confidentiality, integrity or availability

B Only an event where money is stolen from a bank account

2. A student's laptop is found running ransomware that locks their files. Is this a cyber security incident?

A No, it only counts once the ransom has been paid

B Yes, a malware infection compromises availability and possibly other CIA properties

3. An attacker downloads a school's student records without permission. This is an example of a:

A Routine software update

B Data breach, which is a type of incident

4. Which statement about incidents is correct?

A An incident can be potential, where a compromise might happen but has not yet been confirmed

B An incident only exists once data has definitely been stolen

5. Which CIA property is mainly compromised when malware deletes a company's database so staff cannot use it?

A Availability

B Confidentiality

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1incident = breach		Aif event.affects("C", "I", "A"): incident = True
2incident = malware_infection		BA data breach is an incident where confidential data is accessed or disclosed by someone who should not see it
3An incident can be only a potential compromise: a threat to CIA that has not yet caused harm still counts		CStolen data is a breach, which is an incident because confidentiality is compromised. It should be set to True.
4An incident is declared when an event compromises confidentiality, integrity or availability		Dif event.threatens(CIA): log_incident()
5if data_stolen: incident = False		EA malware infection can harm integrity and availability, so it is an incident. It should be set to True.
6if malware_found: incident = False		FA malware infection is an incident where harmful software runs on a system and may damage data or stop it working

Definitions

cyber security incident

Fill in the Blanks

Complete each line of code by filling in the missing parts.

if breach __ malware: incident = True

if breach: _____("Incident")

incident = True if ________: isolate()

malware = ____ if malware: print("Incident")

def check(c, i, a): ______ c or i or a

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A incident = "malware infection"

B hit = []

C if "malware" in incident:

D hit.add("integrity")

E print(hit)

Question 2

A breached = True

B records = 500

C if breached and records > 0

D print("Incident declared")

Question 3

A bad = ["breach", "malware"]

B def is_incident(event):

C return event in bad

D print(is_incident(breach))

Question 4

A incident_type == "data breach"

B loss = "confidentiality"

C print(incident_type, loss)

Question 5

A users = 40

B infected = "12"

C rate = infected / users * 100

D print(rate)

Answer Key

Cyber security incident

Section A: Quick Questions

A — An event that actually or potentially compromises confidentiality, integrity or availability

B — Yes, a malware infection compromises availability and possibly other CIA properties

B — Data breach, which is a type of incident

A — An incident can be potential, where a compromise might happen but has not yet been confirmed

A — Availability

Section B: Match the Pairs

incident = breach → A data breach is an incident where confidential data is accessed or disclosed by someone who should not see it

incident = malware_infection → A malware infection is an incident where harmful software runs on a system and may damage data or stop it working

An incident can be only a potential compromise: a threat to CIA that has not yet caused harm still counts → if event.threatens(CIA): log_incident()

An incident is declared when an event compromises confidentiality, integrity or availability → if event.affects("C", "I", "A"): incident = True

if data_stolen: incident = False → Stolen data is a breach, which is an incident because confidentiality is compromised. It should be set to True.

if malware_found: incident = False → A malware infection can harm integrity and availability, so it is an incident. It should be set to True.

Section C: Definitions

cyber security incident — An event that actually or potentially compromises the confidentiality, integrity or availability of data or systems, such as a data breach or a malware infection.

Section D: Fill in the Blanks

if breach or malware:
    incident = True

if breach:
    print("Incident")

incident = True
if incident:
    isolate()

malware = True
if malware:
    print("Incident")

def check(c, i, a):
    return c or i or a

Section E: Spot the Error

D — Python lists have no add() method, so this raises an error. Use hit.append("integrity") to record the affected security property.

C — An if statement must end with a colon. The line should be: if breached and records > 0:

D — breach has no quotes, so Python treats it as an undefined variable. It must be the string "breach" to match the list.

A — == compares values and does not store one, so incident_type is never created. Use = to assign the value.

B — The quotes make 12 a string, and a string cannot be divided by a number. It should be infected = 12.