Page 190 - CyberSecurityEssentialsEnglish

▣ A practical template: the initial incident card
What happened and when? ....................
Which system, tool, or connector was involved? ....................
What data or decision was affected, and what is the scope? ....................
What has been stopped or contained so far? ....................
Which evidence has been preserved and where? ....................

Who was notified, and what is the next step? ....................

● Remember: Section summary
• Key idea: A correct response stops continuing harm, preserves evidence, and turns the
incident into an improvement.

• Practical decision: Stop and contain, then notify through the proper channel before
making random changes.
• Mistake to avoid: Deleting logs, broadcasting the incident widely, or looking for the
culprit before the harm is stopped.

4.13 The Safe-Use Checklist and the Practical Lab
◆ Key idea: the goal is a better decision, not a longer list.

A checklist is useful when it helps you reach a decision: use, use with limits, escalate, or
do not use. Do not turn it into a formality you tick after the work is finished. Apply it
before entering data, during review, and before publishing or executing.
Table 4-19: The checklist before use

Stage The question Yes or no

Have you defined the purpose, the user, the decision owner, and the
Define ☐
impact of error?

Define Is the data the minimum, classified, and the tool approved for it? ☐

Have you defined what the system proposes and what it neither
Delegate ☐
decides nor executes?

Are the permissions limited, with approval before consequential
Delegate ☐
actions?

Have you separated the claims and identified the source and
Discern ☐
evidence for each?

Discern Have you tested edge cases, language, and the relevant categories? ☐

Have you verified images, audio, or the account through an
Discern ☐
independent channel?

Have you recorded the tool, the sources, the changes, the reviewer,
Document ☐
and the version?

Document Is there a stopping point and a response if an error or a leak appears? ☐

189