Browse Definitions :
Definition

security incident

Contributor(s): Ivy Wigmore

A security incident is an event that may indicate that an organization's systems or data have been compromised or that measures put in place to protect them have failed.

In IT, an event is anything that has significance for system hardware or software and an incident is an event that disrupts normal operations. Security events are usually distinguished from security incidents by the degree of severity and the associated potential risk to the organization.

If a single user is denied access to a requested service, for example, that can be considered a security event because there is some possibility that it indicates a compromised system but the access failure could also be caused by a lot of other things and that single event does not typically have a severe impact on the organization. However, if large numbers of users are denied access, it is likely to mean that there is a more serious problem, such as a denial of service (DoS) attack, so that event may be classified as a security incident.

According to NIST Special Publication 800-61, a security incident is the violation of an explicit or implied security policy.

Examples of security incidents:

  • Attempts from unauthorized sources to access systems or data.
  • Unplanned disruption to a service or denial of a service.
  • Unauthorized processing or storage of data.
  • Unauthorized changes to system hardware, firmware, or software.

Processes and products designed to help with security incident management include incident response planning (IRP), security awareness training and security information and event management (SIEM).

This was last updated in November 2016

Continue Reading About security incident

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.

-ADS BY GOOGLE

File Extensions and File Formats

SearchCompliance

  • risk management

    Risk management is the process of identifying, assessing and controlling threats to an organization's capital and earnings.

  • compliance as a service (CaaS)

    Compliance as a Service (CaaS) is a cloud service service level agreement (SLA) that specified how a managed service provider (...

  • data protection impact assessment (DPIA)

    A data protection impact assessment (DPIA) is a process designed to help organizations determine how data processing systems, ...

SearchSecurity

  • spyware

    Spyware is a type of malicious software -- or malware -- that is installed on a computing device without the end user's knowledge.

  • application whitelisting

    Application whitelisting is the practice of specifying an index of approved software applications or executable files that are ...

  • botnet

    A botnet is a collection of internet-connected devices, which may include PCs, servers, mobile devices and internet of things ...

SearchHealthIT

SearchDisasterRecovery

  • business continuity plan (BCP)

    A business continuity plan (BCP) is a document that consists of the critical information an organization needs to continue ...

  • disaster recovery team

    A disaster recovery team is a group of individuals focused on planning, implementing, maintaining, auditing and testing an ...

  • cloud insurance

    Cloud insurance is any type of financial or data protection obtained by a cloud service provider. 

SearchStorage

  • DRAM (dynamic random access memory)

    Dynamic random access memory (DRAM) is a type of semiconductor memory that is typically used for the data or program code needed ...

  • RAID 10 (RAID 1+0)

    RAID 10, also known as RAID 1+0, is a RAID configuration that combines disk mirroring and disk striping to protect data.

  • PCIe SSD (PCIe solid-state drive)

    A PCIe SSD (PCIe solid-state drive) is a high-speed expansion card that attaches a computer to its peripherals.

Close