Cybersecurity Incident vs. Event

What is the Difference Between a Cyber Incident and an Event?

A cybersecurity incident occurs when something unexpected happens with a computer system, such as a service abruptly halting or functioning less effectively. It can occur due to errors, accidents, or intentional actions. This encompasses instances where regulations governing computer usage are violated or when someone attempts to compromise the integrity of a computer system or the data it contains. It denotes situations where computer malfunctions occur, or malicious activities are perpetrated.

Cybersecurity events are alerts indicating that something unusual is happening in our computer systems. These include instances such as when someone attempts to log in and fails or when our systems detect anomalous activities such as pings or scans. While these events can be concerning, they do not necessarily signify a breach of our security. Nevertheless, they provide valuable insights into potential issues and aid us in identifying emerging threats before they escalate.

What is Incident Reporting and Why It Matters

Cybersecurity incident reporting is the process of notifying relevant parties when a security breach or cyberattack occurs.   These incidents must be handled quickly and with care to mitigate damage and prevent future attacks.

By reporting incidents through the appropriate channels, organizations can initiate incident response plans to contain and remediate issues before they escalate into more serious breaches. Detailed reporting also provides valuable information that can be analyzed to identify trends, uncover systemic weaknesses, and improve defenses against future attacks. Proper documentation creates an audit trail that demonstrates due diligence in the event of litigation or regulatory inquiries.

It is critical to report these incidents because they provide the context needed by security professionals to document responses.

When an incident occurs, it's crucial to document the details.  The who, what, when, where, and how to provide invaluable insight.  This incident report becomes a road map, decoding how to prevent future mishaps.  Assessing the breach's origin helps identify vulnerabilities.  

The report fuels more innovative policies, tighter compliance, and proactive risk management.  Prompt and proper reporting allows the State to take swift action, conduct forensic analysis, and remediate vulnerabilities. Use the information below as a guide when gathering information to report an incident or event.

• Date and time when the incident or event first occurred

• Date and time when the incident or event was detected

• Description of the problem. Include any odd behaviors observed