Types of security incidents are divided into several main categories:

• confidentiality breach – unauthorized access to information,
• availability disruption – the system becomes unavailable, paralyzing services,
• integrity violation – data is intentionally modified or manipulated,
• control takeover – an unauthorized user gains access to resources,
• social engineering attacks – e.g., phishing used to obtain data through user manipulation.

As much as 95% of incidents are caused by human error. Moreover, the average time to detect a breach is nearly 10 months, giving cybercriminals a lot of time to cause damage.

Symptoms that may indicate an incident:

• unusual computer behavior – slowdowns, crashes, self-launching applications,
• the appearance of new accounts or changes in user permissions,
• strange login attempts – e.g., at odd hours or from unusual locations,
• increased network traffic without justification,
• presence of unknown files or sudden changes in existing documents,
• warnings from antivirus software or firewalls.

Clear signs of a breach:

• ransom demand messages – typical of ransomware attacks,
• automatic redirection to suspicious websites,
• blocked access to accounts or services,
• unauthorized financial transactions,
• suspicious messages from contacts with strange links.

What to do if you suspect an incident:

1. Immediately disconnect the device from the network – this will limit the spread of the threat.
2. Document all symptoms – take screenshots, save messages, note unusual behavior.
3. Change all passwords – using a trusted, uninfected device.
4. Notify the appropriate parties – IT administrator, supervisor, bank.
5. In case of a serious breach the national cybersecurity agency.

Prevention significantly reduces the risk of incidents. It is worth:

• regularly backing up data,
  • updating software and the operating system,
  • using reputable antivirus software,
  • learning to recognize techniques used by cybercriminals,
  • having a response plan in case of an attack.

A quick response and preparation can significantly reduce the impact of an attack and ensure the confidentiality, integrity, and availability of data.

Why is an operating system update important for cyber security?