Describe incidents with security goals

Translate messy incidents into clear security language by naming the asset, the harm, and the goal that failed. Practice labeling one event as a confidentiality, integrity, availability, accountability, or resilience problem without treating those goals as mutually exclusive.