Which elements should incident reporting include?

Which elements should incident reporting include?

• A. Intruder's activity, intensity, vulnerability, and design/impact
• B. Time of detection and system uptime
• C. Hardware specs and vendor support
• D. None of the above

Answer: (A)

When documenting an incident, you want a clear picture of what happened and why it matters. The best choice includes the attacker’s activity (what the intruder did), the intensity or severity of the activity (how impactful or sustained the attack was), the vulnerability that was exploited (which weakness allowed the intrusion), and the design or operational impact (how the system or its design was affected). This combination gives responders and investigators a complete story: what occurred, how serious it was, where the weakness lies, and what the consequences were. Time of detection and system uptime, while useful for building a timeline, don’t by themselves describe the incident’s nature or its impact. Hardware specs and vendor support are not central to understanding the incident itself and are better suited for asset management or procurement discussions.

When documenting an incident, you want a clear picture of what happened and why it matters. The best choice includes the attacker’s activity (what the intruder did), the intensity or severity of the activity (how impactful or sustained the attack was), the vulnerability that was exploited (which weakness allowed the intrusion), and the design or operational impact (how the system or its design was affected). This combination gives responders and investigators a complete story: what occurred, how serious it was, where the weakness lies, and what the consequences were.

Time of detection and system uptime, while useful for building a timeline, don’t by themselves describe the incident’s nature or its impact. Hardware specs and vendor support are not central to understanding the incident itself and are better suited for asset management or procurement discussions.