Which of the following statements would describe the term "incident" when used in the branch of security known as Incident Handling?A. Any observable…

In the context of incident handling, an "incident" is not just any observable occurrence. It is a specific type of adverse event. According to the National Institute of Standards and Technology (NIST), a computer security incident is a violation or an imminent threat of violation of security policies. This definition encompasses both actual harm that has occurred to systems (a violation) and a significant threat that harm is about to occur (an imminent threat). Therefore, an incident is characterized by either realized damage or a credible, impending threat to an organization's assets.

A. Any observable network event: This defines an "event," not an "incident." Most network events, such as a successful login or a DNS query, are benign and not considered incidents.

The other answer choices (A, B, and D) are incorrect because they include option A, which is the definition of an event, not an incident.

1. NIST Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide. Section 2.1

"Definitions of Event and Incident" (Page 2-1).

"An event is any observable occurrence in a system or network."

"A computer security incident is a violation or imminent threat of violation of computer security policies

acceptable use policies

or standard security practices." This directly supports that an incident involves both a "violation" (harm) and an "imminent threat" (significant threat of harm).

2. Carnegie Mellon University

Software Engineering Institute

CERT Resilience Management Model (CERT-RMM) v1.2. Glossary (Page 369).

The glossary defines an incident as: "An event that actually or potentially jeopardizes the confidentiality

integrity

or availability (CIA) of an information system or the information the system processes

stores

or transmits..." This definition supports that an incident can be an event causing actual or potential harm.