Chapter 2 · Cybersecurity
2-3 Incident Response and Risk Management
Even a well-protected system can be attacked. When a security incident happens — data leaked, files tampered with, or a service knocked offline — a rushed and unplanned reaction only makes the damage worse. Organizations follow a clear, ordered response, and decide in advance which risks to guard against first, because no team can fix everything at once.
Guiding question
When a security incident happens, how should an organization respond in order — and how does it decide which risks to address first?
Learning outcome. Explain what a security incident is and describe the stages of incident response in the correct order, and apply risk assessment by prioritising risks according to their impact and likelihood.
With a partner. Imagine a small fire starts in a room. Write down, in order, the first four things you would do. Then check: did either of you put “tidy up and repaint the room” before “put the fire out”? Hold on to that instinct — this lesson is about exactly it.
What is a security incident?
Security incident … a situation in which actual damage occurs due to an information security problem.
| Type | Description |
|---|---|
| Information leak | Personal information or confidential information is leaked to the outside |
| Data tampering | Data within a system is altered without authorisation |
| Service outage | A service becomes unavailable due to attacks on the server, etc. |
The words “actual damage” are doing work. A software update, a suspicious email nobody clicked, a scan that found nothing — none of those are incidents. Something has to have gone wrong.
The flow of incident response
| Stage | Description |
|---|---|
| ① Preparation | Establish response procedures and structures in advance, in preparation for incidents. |
| ② Detection | Discover and confirm that an incident has occurred. |
| ③ Containment | Limit the scope of impact so that damage does not spread further. |
| ④ Eradication | Remove the cause of the incident (e.g., remove malware). |
| ⑤ Recovery | Return systems and services to their normal state. |
| ⑥ Prevention of recurrence | Analyze the cause and take measures so that the same incident does not occur again. |
The order is the rule, and here is why.
It is important to proceed through the six stages in order. For example, if recovery is performed without identifying the cause, the same incident may occur again. Containment before eradication matters for the same reason: stop the spread first, then remove the cause without it spreading while you work.
Six stages, and the book is clear that they must be carried out in order. Press ① to begin — or press the red button below to see what happens if you jump ahead.
The concept of risk assessment
Risk … the possibility of an information security problem occurring in the future, and its impact.
Risk size = Impact × Likelihood
① Impact … how much damage occurs if the risk actually materialises.
② Likelihood … how high the probability is that the risk will actually materialise.
Risks with both high impact and high likelihood should be addressed first. Since it is difficult to address all risks at the same time, it is important to set priorities and take measures systematically.
Press any cell, or set impact and likelihood, and watch the risk band change. This is the book’s own matrix.
| High | |||
| Medium | |||
| Low | |||
| Low | Medium | High |
rows: impact · columns: likelihood
impact High (3) × likelihood High (3) = 9
Critical
Both factors matter, and that is the point of the question. A rare disaster and a constant nuisance can score the same. Risks that are high on BOTH are dealt with first — because no team can fix everything at once, so priorities have to be set.
How the real paper is built
The ministry sets half multiple choice and half written answer in every subject. The two halves are not the same skill. In the multiple-choice half you have to spot the wrong options quickly — and the wrong options are built out of the mistakes students really make. In the written half nobody gives you the answer to recognise; you have to produce it, in your own words, with a reason.
Practise both. Being good at one half and weak at the other costs you exactly half the paper.
- security incident
- — a situation in which actual damage occurs from an information security problem.
- containment
- — limit the spread of damage.
- eradication
- — remove the cause.
- impact
- — how much damage occurs if a risk happens.
- likelihood
- — how probable the risk is.
You can now work out risk = impact × likelihood and rank a list. But why multiply? Why not add them, or average them, or simply always deal with the worst possible disaster first? The answer is worth having, because it is also the answer to when this formula should not be trusted.
🧮 Why it has to be a multiplication
- 1
Try adding instead, and test it on two risks. Risk P: impact 2, likelihood 2. Risk Q: impact 3, likelihood 1.
Why this step: The way to test a proposed rule is to find a case where it gives an answer you can check against common sense. Two risks that differ in character are the right test.
- 2
Add them: P scores 2 + 2 = 4, and Q scores 3 + 1 = 4. A tie.
Why this step: And a tie is useless — the entire purpose of scoring risks is to put them in an order so a team knows what to do first. A rule that cannot separate two clearly different risks has failed at its only job.
- 3
Multiply instead: P scores 2 × 2 = 4, and Q scores 3 × 1 = 3. P comes first.
Why this step: Now they separate, and in the sensible direction: a moderate problem that happens regularly will do more total harm over a year than a bigger problem that almost never happens.
Most people slip here: This is not saying the rare disaster does not matter. It is saying that if you can only fix one thing this week, the frequent one is costing you more right now.
- 4
See what the multiplication actually is: “how bad each time” × “how often” = how much damage on average.
Why this step: This is the real reason, and once you have it the formula stops being arbitrary. Multiplying an amount by a frequency gives a total — the same arithmetic as 3 meals × 12 EGP. Adding a likelihood to an impact adds two things measured in different units, which produces a number that means nothing at all.
🧮 The same idea with real money — which risk would you fix first?
- 1
Ransomware: about a 5% chance in a year, and it would cost about 200,000 to recover from.
Why this step: Real risk work replaces the 1-to-3 scale with actual probabilities and actual costs. The arithmetic is identical — the book’s scale is this calculation with the numbers rounded to three levels.
- 2
Multiply: 0.05 × 200,000 = 10,000 per year.
Why this step: Read that as: if you ran this organisation for many years, ransomware would cost you about 10,000 a year on average. Most years nothing; occasionally a very bad year.
Most people slip here: It does not mean you will lose 10,000 this year. In any single year you lose either nothing or 200,000. The average is a planning figure, not a prediction.
- 3
Laptop theft: 40% chance, 2,000 to replace → 0.40 × 2,000 = 800 per year.
Why this step: This one happens constantly and feels like the pressing problem, because it is the one people keep reporting. The arithmetic says it is the smallest of the three.
- 4
Service outage: 20% chance, 30,000 in lost business → 0.20 × 30,000 = 6,000 per year.
Why this step: Neither the most likely nor the most expensive, which is exactly why it needs calculating rather than judging — it is the kind of risk that gets overlooked from both directions.
- 5
Rank them: ransomware 10,000, outage 6,000, theft 800.
Why this step: And notice the ranking matches neither of the things a team would argue about in a meeting: the most likely risk (theft) comes last, and the ordering is not the ordering of the costs either. That is what the formula is for.
For the exam, use the book’s rule: risk = impact × likelihood, largest first. But if a question gives you a risk that would destroy the whole organisation, saying that it deserves attention beyond what its score suggests — because the damage is unrecoverable — is a strong point, not a wrong one.
Read that against the six stages you learned in this lesson. The failure is in ① preparation, and it only became visible at ⑤ recovery, which is the worst possible moment to discover it. This is the practical meaning of the first stage being a stage at all: a plan nobody has ever tested is not preparation, it is an assumption.
A pattern reported after ransomware incidents across many organisations.
Worked Example
(1) Mark each statement with ○ if it is true or × if it is false.
A A security incident is a situation in which actual damage occurs due to an information security problem.
B In incident response, it is important to first prevent the spread of damage before removing the cause.
C The size of a risk can be determined by impact alone.
D The final stage of incident response is prevention of recurrence.
(2) Match each action (a–d) with its stage: A Preparation, B Containment, C Eradication, D Prevention of recurrence.
a Establishing response procedures in advance, in preparation for incidents
b Disconnecting a malware-infected computer from the network
c Removing the malware infection
d Analyzing the cause and taking measures so that the same incident does not occur again
1 · Answer the following questions.
2(1) · Which is NOT an appropriate example of a security incident?
Mark ○ for each one that IS a security incident, and × for the one that is not.
Data was encrypted by a ransomware infection.
Customer information was leaked to the outside through unauthorised access.
A software update was performed to add new features.
A web service became unavailable due to an attack on the server.
2(2) · Which most appropriately describes the concept of risk assessment?
Mark each statement with ○ if it is true or × if it is false.
It is enough to address only risks with large impact.
It is enough to address only risks with high likelihood.
Risks with both high impact and high likelihood should be addressed first.
All risks must be addressed simultaneously.
Think as an Engineer — Investigate & Decide
A school’s student-records system is hit by ransomware: files are encrypted and staff cannot log in. You lead the response.
1 · Respond from here.
This incident has just been detected — files are encrypted and staff are locked out. Starting from where the school is now, list the stages still to carry out, and say what each one means for this specific incident.2 · Assess the risks.
For two risks the school faces — (i) another ransomware attack and (ii) a brief power cut — estimate impact and likelihood, and say which to address first.3 · Decide.
Recommend the first three actions the school should take, and give one reason why order matters. In pairs, compare your orders and agree together on the single most important first step. Give evidence for your answer.
Notice what the two options really are. “Restore from backup immediately” is jumping straight to stage ⑤. It is the tempting choice because it is the one that makes the complaints stop — and it is the one that lets the same attack happen again next week.
In a New Context
Lesson Question — Answered
The lesson asked how to respond to an incident in order, and how to prioritise risks. A security incident is any situation where real damage occurs. The response follows six stages in a fixed order — preparation, detection, containment, eradication, recovery, and prevention of recurrence — because acting out of order (for example, recovering before removing the cause) lets the same incident return.
To decide what to guard against first, an organization assesses each risk by its size = impact × likelihood, and addresses high-impact, high-likelihood risks first, since no team can fix everything at once. Responding in order and prioritising by risk together keep damage small and prevent repeats.
1 · Quiz yourself first.
Cover the Point! sections and say the six stages in order without looking, then say what impact and likelihood each mean.
2 · Read the passage and fill in the blanks.
A situation in which actual damage occurs due to an information security problem is called ( a ). When ( a ) occurs, ( b ), which prevents the spread of damage, is performed first, followed by ( c ), which removes the cause of the incident. After that, ( d ), which returns the system to its normal state, is performed, and finally ( e ), in which the cause is analysed to prevent recurrence, is performed.
3(1) · Reorder the risks from highest priority to lowest, using impact × likelihood.
a Impact: large (3), Likelihood: high (3)
b Impact: small (1), Likelihood: high (3)
c Impact: large (3), Likelihood: medium (2)
d Impact: small (1), Likelihood: low (1)
3(2) · Which most appropriately describes the order of incident response?
Mark each statement with ○ if it is true or × if it is false.
Detection → Eradication → Containment → Recovery
Preparation → Detection → Containment → Eradication → Recovery → Prevention of recurrence
Detection → Recovery → Containment → Prevention of recurrence
Containment → Detection → Eradication → Preparation
Reflect: Which stage of incident response do you think is hardest to do well under pressure, and why?
Challenge: Suggest one thing an organization could prepare in advance (stage ①) that would make the other stages faster.
Sign In to Keep Going
You've reached the end of the free preview. Sign in — and upgrade to Plus or Pro — to keep going with Programming and Artificial Intelligence.
Full Access
Unlock all 30 lessons