Page 188 - CyberSecurityEssentialsEnglish

● Remember: Section summary
• Key idea: High-impact domains permit limited support but require expertise,
explanation, review, and a route of appeal.
• Practical decision: Separate administrative work from the professional decision and
define a clear escalation point.
• Mistake to avoid: Letting an assisting tool drift into becoming the decision maker
through convenience or time pressure.

4.12 Incident Response: What Do You Do When Something Goes Wrong?
◆ Key idea: stop the harm first.
When data leaks, an execution misfires, forged content appears, or an inaccurate

decision is taken, do not begin by looking for who is to blame or by deleting all the
evidence. Stop the action, contain the access, preserve the logs, notify the right party,
correct the effect, then learn and adjust the controls.

An incident is an event that has caused or may cause harm: uploading a confidential file to

an unapproved service, sending a wrong message automatically, adopting a fabricated
figure, an agent responding to a malicious instruction, or publishing impersonated content.
A near miss is an error caught before harm occurred, and it deserves recording because it

reveals a weakness in the process.

The first step is to stop: halt the sharing, the sending, or the automatic operation. Then
contain: revoke the permission, rotate the exposed key, isolate the connector, and remove
the public link where possible. Do not assume that deleting a conversation alone removes

every copy or trace.

Preserve the evidence: the time, the message, the file, the email headers, the tool log, the
settings, and screenshots where needed. Do not alter the original. Specialist teams need this

information to understand the scope, and preservation may be required by legal or security
procedure.

Notify through the organization’s channel: information security, privacy, management,
technical support, or the relevant specialist. Do not publish the details of an incident in a

wide channel; share the minimum with those who need to respond. If people have been
affected, notification duties may apply, and specialists will determine them.

Correct the effect: replace the document, tell recipients of the correction, cancel the action,
or retake the decision. Then learn: what caused the incident? An ambiguous task, an over-

broad permission, a gap in training, a confusing interface, or a missing review point? The
remedy must change the system or the process rather than merely blaming the user.

187