Lesson 2-3 explained: Incident Response and Risk Management

Lesson summary

A security incident is any situation where real damage occurs.

Takeaway: Follow the six stages in order (prepare → detect → contain → eradicate → recover → prevent), and prioritize risks by impact × likelihood.

Key terms

• Security incident
• Containment
• Eradication
• Risk
• Impact
• Likelihood

Textbook page: Arabic book 44 · English book 48

Free questions on this lesson

From the textbook question bank. Think of the answer first, then open it.

1. 1. What is a security incident, according to the lesson?

   • Any software update that adds new features to a system
   • The chance of a future problem, with no damage so far at all
   • A situation where actual damage occurs from a security problem
   • A plan written in advance to face problems before they happen
   Answer

   Correct answer: A situation where actual damage occurs from a security problem

   A security incident is a situation in which actual damage occurs due to an information security problem.

   1. What is a Security Incident · page 49

2. 2. The security team removed the malware from the infected server. Which stage is this?

   • Containment
   • Prevention of recurrence
   • Eradication
   • Detection
   Answer

   Correct answer: Eradication

   Removing the malware removes the cause: eradication.

   2. The Flow of Incident Response · page 49

3. 3. Which risk comes first: (a) impact 3 × likelihood 1, or (b) impact 2 × likelihood 2?

   • They are exactly equal
   • They cannot be compared
   • (b), since its score 4 beats 3
   • (a), since its impact is biggest
   Answer

   Correct answer: (b), since its score 4 beats 3

   (a) = 3 × 1 = 3 and (b) = 2 × 2 = 4, so (b) first. Impact alone does not set risk size.

   3. The Concept of Risk Assessment · page 50

Lessons in this chapter 2: Cybersecurity

1. 2-1 Cryptographic Technologies and Authentication
2. 2-2 Network Security Design
3. 2-3 Incident Response and Risk Management