The first 24 hours of a cyber incident: what to do, and what not to

Most organisations discover an incident through something odd: a ransom note, an alert nobody understands, a supplier asking why they received a strange invoice from your mailbox. What happens next is usually improvised. A few simple rules make a large difference.

Do not switch everything off

Pulling the power destroys memory, which often holds the attacker's tools, network connections and encryption keys. Where possible, isolate affected machines from the network using your endpoint detection tool or by disconnecting the network cable, and leave them running until the evidence is captured.

Preserve the evidence

• export logs from firewalls, VPNs, email, identity systems and cloud consoles before they roll over;
• take memory and disk images of key systems;
• record who did what, and when, from the first minute;
• keep a chain of custody for anything that may be needed by police, insurers or courts.

Communicate out of band

If the attacker has access to email or chat, they may be reading your response. Move the incident team to phones or a separate, clean channel. Agree who speaks to staff, customers, insurers and the press, and say nothing publicly until the facts are checked.

Scope before you clean

The temptation is to reset passwords and rebuild the first infected machine straight away. If the attacker has other footholds, they will see the reaction and change tactics. Find out how they got in, which accounts they used and where else they went, then remove them everywhere at once, including credential resets for privileged and service accounts.

Check your obligations

Data protection law, sector regulators, cyber insurance policies and customer contracts may each require notification within set deadlines. Make a list on day one, with the date and time each clock started.

Afterwards

Restore from backups you have verified are clean, monitor closely for return attempts, and write a short report with the cause, the timeline and the fixes. The lessons are only useful if someone owns them.

Our incident response team is available around the clock for containment, forensic investigation and recovery, and also helps clients prepare plans and rehearse them before they are needed.