Focus students’ attention that regardless of whether an incident indicator was possible, probable, or definite, action still must be taken because consequences can still result that could be detrimental for an organization.
Review the five most likely outcomes that an incident can cause. Whether it is a credible threat or a system having issues, these can all result:
Loss of availability: Information or information systems become unavailable.
Loss of integrity: Users report corrupt data files, garbage where data should be, or data that just looks wrong.
Loss of confidentiality: There is a notification of a sensitive information leak, or information that was thought to be protected has been disclosed.
Violation of policy: There is a violation of organizational policies addressing information or InfoSec.
Violation of law or regulation: The law has been broken, and the organization’s information assets are involved.