Discerning Between a Data Breach and a Security Incident Can Fuel Your Response to Each

Cybersecurity is an incredibly important part of any business, but there are slight differences in various terms that can make for huge misunderstandings. For example, the average office worker might hear of “data breaches” and imagine they are “security incidents.” They might not technically be wrong, but the two terms aren’t exactly the same, either. Let’s examine the definitions and provide some clarity on these terms.

What is a “Data Breach?”

A breach occurs when someone outside of your organization accesses some of your business’ data through their own specific efforts. Trend Micro defines it as “an incident wherein information is stolen or taken from a system without the knowledge or authorization of the system's owner.”

Essentially, a breach is when data stored by your business is accessed by an unauthorized user. A data breach is not necessarily a malicious action, but it is still a problem.

What is a “Security Incident?”

A security incident refers to any violation of established security policies within your organization, no matter how small. A security incident is, again, not inherently malicious, but they are still problematic for any organization, particularly in regards to security and compliance.

As a blanket term, “security incident” covers a wide range of circumstances, including:

• Malware infection
• Spam hitting an unbox
• Physical access to IT equipment and infrastructure
• A Distributed Denial of Service (DDoS) attack
• Portable storage being misused
• A brute force attack enabling network access

Security incidents are usually categorized according to their severity, as in how serious the incident is and how much of a company’s attention has been given to resolve them. Serious problems like data breaches, Distributed Denial of Service attacks, and advanced persistent threats (APTs) are considered high-priority security incidents, whereas others like malware infections or unauthorized account access might be considered medium priority. Low-key incidents would be things like false alarms or false positives.

Isn’t This Just a Difference in Semantics?

It might not seem like a big difference, but the difference is in fact quite important. If you don’t know what type of security issue you are dealing with, you don’t know how to resolve it. If you can encourage your team to use the correct terminology when discussing security threats, you can ensure that they know the warning signs and are able to appropriately report what they are experiencing. This will give your business the ability to catch and resolve threats before they become even worse problems.

We Can Help You Prevent Threats from Getting That Far

For any security initiative, it’s important for users to be aware of how their actions can impact the entire organization. SCW can help you train your employees and implement comprehensive security measures to keep your company safe. To learn more, reach out to us at (509) 534-1530.