Cybersecurity Foundations (Grades 6–8) · lesson 38 of 48 · 8 min
When Something Goes Wrong — Incident Response Basics
No security system is perfect. At some point, something will go wrong — a device will be infected, an account will be compromised, or suspicious activity will be detected. How you respond in the first minutes and hours determines how much damage is done.
Incident response is the structured process of identifying, containing, investigating, and recovering from security incidents. Even at a personal level, knowing the right steps to take — and the wrong ones to avoid — can mean the difference between a minor inconvenience and a catastrophic loss.
By the end of this lesson you will be able to recognise the signs of a security incident, follow the correct initial response steps, write a basic incident report, and understand why early reporting is critical.
The dwell time problem
Security researchers have found that the average time between an attacker gaining access to a network and being detected is 197 days. During that time, attackers can steal data, install backdoors, and spread to other systems. Early detection and reporting dramatically reduces this “dwell time” and limits the damage an attacker can do.
What Is a Security Incident?
A security incident is any event that threatens the confidentiality, integrity, or availability of information or systems. Incidents range from a single phishing email to a full ransomware attack. Not every incident is a breach — but every incident needs to be assessed.
Knowing how to recognise and report an incident is a foundational skill for anyone working in or around technology. Early reporting limits damage, speeds recovery, and helps organisations learn from what happened.
Types of Security Incidents
The Incident Reporting Process
When you suspect a security incident, follow these steps in order:
What to Include in an Incident Report
Knowledge Check
Incident Reporting Basics
You notice your school laptop is running very slowly and files have strange extensions. What should you do first?
- Restart the computer
- Disconnect from the network to contain the incident
- Delete the strange files
- Run a Google search for the file extensions
Answer: Disconnect from the network to contain the incident
Disconnecting stops the malware from communicating with attackers and prevents it from spreading to other devices on the network.
You should turn off an infected computer immediately to stop the malware.
- True
- False
Answer: False
Turning off a computer can destroy forensic evidence stored in memory (RAM). Disconnect from the network instead, and let IT staff decide when to power down.
Which of these is NOT something you should include in an incident report?
- Date and time of the incident
- What device or account was affected
- Your guess about who is responsible
- What actions you took
Answer: Your guess about who is responsible
Incident reports should contain facts, not speculation. Guessing who is responsible can misdirect investigations. Report what you observed.
Why is early reporting of a security incident so important?
- It prevents the attacker from knowing they were detected
- It limits the time attackers have to steal data and spread through the network
- It automatically removes the malware
- It is required by law for all incidents
Answer: It limits the time attackers have to steal data and spread through the network
The longer an attacker goes undetected, the more damage they can do. Early reporting triggers containment and investigation.
After identifying an incident, the next step is to _____ it — stopping it from spreading to other devices.
Answer: contain
Containment is the second step in incident response. Disconnecting the affected device from the network is the most common containment action.
Real-World Case Studies
Case 1: The SolarWinds Attack — 9 Months Undetected
In 2020, attackers (later attributed to Russian intelligence) compromised SolarWinds’ software build process and inserted malware into a routine software update. The malware was distributed to 18,000 organisations, including US government agencies. It went undetected for 9 months. The breach was eventually discovered by a cybersecurity firm (FireEye) that noticed unusual activity on its own network. The lesson: sophisticated attackers can remain hidden for months. Detection and reporting systems — and the people who use them — are the only way to find them.
Case 2: The Uber Cover-Up — What Not to Do
In 2016, Uber suffered a data breach affecting 57 million users and 600,000 drivers. Instead of reporting the breach (as required by law), Uber paid the attackers $100,000 to delete the data and keep quiet. The cover-up was discovered in 2017. Uber’s Chief Security Officer was later convicted of obstruction of justice. Uber paid $148 million in settlements. The lesson: covering up a security incident is always worse than reporting it. Incident reporting is not just good practice — it is often a legal requirement.
Previous lesson: Home network safety
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Reading a security alert