Which of the following statements describes the term “incident” as used in the security discipline of Incident Handling?
In the security discipline of Incident Handling as taught in the SANS/GIAC curriculum, the term "incident" is defined broadly: it covers a violation (or imminent threat of violation) of explicit or implied security policy, an adverse event or the threat of one that jeopardizes the confidentiality, integrity, or availability of information assets, and any event that disrupts normal operations regardless of whether it stems from malicious action or an accidental/environmental cause. Because the definition intentionally spans all of these dimensions rather than a single narrow criterion, the combination that includes all three descriptive statements is the one that accurately captures how the term is used in Incident Handling practice.
Community Discussion