[Introduction to Incident Handling and Response] Which one of the following is Inappropriate Usage Incidents?

Inappropriate Usage incidents are defined as a violation of an organization’s acceptable use policies by an authorized user. An "insider" is an authorized user with legitimate access to an organization's assets. Therefore, an incident originating from an "Insider Threat," such as an employee using company systems for personal commercial gain or accessing data in violation of policy, directly falls under the Inappropriate Usage category. The other options represent distinct incident categories typically associated with external threats or different technical impacts.

B. Reconnaissance Attack: This involves unauthorized scanning or probing to gather information about a target system, categorized separately as "Scans/Probes/Attempted Access."
C. Access Control Attack: This is an attempt to gain unauthorized access to a system or data, which is classified under the "Unauthorized Access" category.
D. Denial of Service Attack: This attack aims to prevent legitimate users from accessing information or services and is its own distinct incident category.

1. Mell

P.

Kent

K.

& Grance

T. (2012). NIST Special Publication 800-61 Rev. 2: Computer Security Incident Handling Guide. National Institute of Standards and Technology. Section 2.3.1

"Incident Categories

" defines "Inappropriate Usage" as "A violation of an organization’s acceptable use policies by an authorized user." This inherently links the incident type to an insider. The document also lists Denial of Service and Unauthorized Access as separate categories. (https://doi.org/10.6028/NIST.SP.800-61r2)

2. University of California

Berkeley

Information Security Office. (n.d.). Incident Response. Berkeley Security. The "Incident Classification" section lists "Inappropriate usage" as a major incident category

defining it as a violation of the acceptable use policy

which is an action performed by an authorized user or insider. (Retrieved from https://security.berkeley.edu/incident-response

under the "Incident Classification" section).

3. Carnegie Mellon University Software Engineering Institute. (2017). Defining Incident Management Processes for CSIRTs. Section 3.2

"Incident Classification

" discusses various taxonomies

often aligning with the NIST framework where inappropriate usage is tied to policy violations by internal users

distinguishing it from external attacks like DoS or reconnaissance. (Retrieved from https://resources.sei.cmu.edu/assetfiles/WhitePaper/2017019001503734.pdf

Page 10).