Information Security Management, 2nd Edition

2.5 Cybersecurity Incidents

Security incidents transcend across all departments. Despite the best efforts of organizations to anticipate and prevent security lapses or prevent attacks from succeeding, incidents do occur. These may range from a recently fired employee who returns to the workplace with the intention to harm other employees (e.g., active shooter incidents), to attacks on computer systems. Here, we will stick to cybersecurity incidents. A cybersecurity incident involves (1) theft or misuse of sensitive information, (2) an event that negatively impacts network or system infrastructure, (3) an unauthorized access, or (4) systems used as a launch pad for staging other attacks, such as being part of a botnet. To deal with incidents, ...