The Unite Group
0191 466 1050Talk to us
The Unite Group
Call 0191 466 1050Talk to us

Cyber incident response: what to do in the first hour

Cyber Security4 min read

Lit green emergency exit sign on a dark stone wall

At some point, most organisations have a cyber incident: a compromised account, ransomware, a stolen laptop or a fraudulent payment. The first hour will not fix everything, but it decides how bad things get. Here is a simple plan you can adapt, and rehearse, before you need it.

Before anything happens

An incident is the wrong time to find out who does what. Do these now:

  • Name an incident lead and a deputy
  • Keep a contact sheet on paper or somewhere independent of your network: IT provider, insurer, legal adviser, senior managers, key suppliers
  • Know where your backups are and how to reach them. Our guide to backups and business continuity helps here
  • Check your cyber insurance. Many policies require you to call a helpline first, and acting before you do could affect cover

The first hour

1. Stay calm and raise the alarm

Tell the incident lead and your IT provider straight away, by phone. Do not use a system you think is compromised to discuss it. If email might be affected, use a phone or a separate messaging account.

2. Contain it

The aim is to stop it spreading.

  • Disconnect affected devices from the network, by unplugging the cable or turning off WiFi. Do not switch them off unless you are told to, because that can destroy useful evidence held in memory.
  • Disable compromised accounts and reset passwords from a clean device
  • Revoke active sessions and check for suspicious sign-in locations
  • Protect the backups. Disconnect backup systems from the network if ransomware is suspected

If you have endpoint detection and response, your provider can often isolate a machine remotely. See EDR vs antivirus.

3. Preserve evidence

Write things down as you go: what was noticed, when, by whom, what was done. Take photos of ransom notes or error screens. Do not wipe or rebuild systems before specialists have taken what they need.

4. Work out what you are dealing with

Ask quick questions:

  • What systems and data are affected?
  • Is personal data involved?
  • Is the attacker still active?
  • Is money at risk, for example a payment that can still be recalled?

If a fraudulent payment was made, call your bank immediately. The faster you call, the better the chance of recovering funds.

5. Get help

Call your IT provider or incident response specialist, and your insurer if you have cover. The NCSC has guidance on incident management, and it runs a scheme that certifies cyber incident response providers, which can help you choose a specialist for serious attacks.

The first day

Once you have contained the problem:

  • Report a personal data breach. If personal data has been exposed and it is likely to put people at risk, UK GDPR requires you to tell the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it. You must also record every breach, even those you do not report. If there is a high risk to individuals, you may need to tell them too.
  • Report the crime. Use Report Fraud (formerly Action Fraud) to report cyber crime in the UK. confirm current UK police reporting service name and URL before publishing
  • Tell the people who need to know, such as customers, partners and regulators, with accurate, calm messages. Agree the wording first.
  • Decide on restore priorities. Bring back the most critical systems first, from clean backups, once you are confident the attacker has been removed

Should you pay a ransom?

The NCSC and law enforcement advise against paying. Payment does not guarantee you get your data back, and it encourages further attacks. Take advice from specialists and your insurer before making any decision. There may also be legal issues, such as sanctions.

Afterwards

When the dust settles, run a short review without blame:

  1. How did they get in?
  2. What worked, and what did not?
  3. What will we change? Multi-factor authentication, patching, training, backups?

Feed this back into your plan, and test the plan again. Rehearsing even once a year, with a simple “what if” scenario, makes a big difference.

Make it routine

Prevention lowers the odds, but a plan lowers the damage. For the full picture of prevention, detection and recovery, see our cyber security hub. And phishing is one of the commonest starting points, so spotting and stopping phishing is a sensible next read.

Not sure you have a plan? Talk to us about cyber security and we will help you write and test one.