What Should You Do In The Event Of A Cyber Attack?
The moment you discover a cyber attack is crucial. The actions taken in the first hours can mean the difference between a contained incident and a catastrophic breach. This guide outlines the essential steps every organisation should take when responding to a security incident.
Step 1: Don't Panic - But Act Quickly
Panic leads to poor decisions. While urgency is critical, rushing without thinking can make things worse. Take a breath, then methodically work through your incident response plan. If you don't have a documented plan, now you'll understand why it's essential - but focus on the immediate crisis first.
Step 2: Contain the Threat
Your first priority is stopping the attack from spreading. Depending on the nature of the incident, containment might include:
- Isolate affected systems: Disconnect compromised machines from the network, but don't turn them off - you'll need forensic evidence
- Disable compromised accounts: Reset passwords for any accounts that may have been breached
- Block malicious IPs: If you've identified attacker infrastructure, block it at your firewall
- Preserve evidence: Don't delete anything - forensic investigators need complete logs and system states
The goal of containment isn't to understand what happened - it's to stop things from getting worse. Investigation comes later.
Step 3: Activate Your Incident Response Team
Alert the appropriate people immediately. Your incident response team should include:
- IT security personnel
- Senior management
- Legal counsel
- Communications/PR team
- External security consultants if needed
Establish a dedicated communication channel for incident response. Avoid using potentially compromised systems for sensitive discussions.
Step 4: Assess the Scope
Once immediate containment is in place, begin understanding the full extent of the breach:
- What systems were accessed?
- What data was potentially exposed?
- How did the attackers gain entry?
- How long have they been in your systems?
- Are they still active?
This assessment informs your recovery strategy and helps determine notification requirements. Under GDPR and other regulations, certain breaches must be reported within 72 hours.
Step 5: Notify Appropriate Parties
Depending on the breach severity and applicable regulations, you may need to notify:
- Regulators: ICO (UK), relevant data protection authorities
- Law enforcement: National Cyber Security Centre, Action Fraud, or police
- Affected individuals: If personal data was compromised
- Insurance provider: If you have cyber insurance
- Business partners: If shared systems were affected
Step 6: Eradicate and Recover
Only after thorough containment and assessment should you begin recovery:
- Remove all traces of the attack from your systems
- Patch the vulnerabilities that allowed entry
- Rebuild compromised systems from clean images
- Restore data from verified clean backups
- Implement additional security controls
- Monitor closely for signs of continued compromise
Step 7: Learn and Improve
After the immediate crisis, conduct a thorough post-incident review. Document what happened, what worked, what didn't, and what changes are needed. This review should inform updates to your security controls and incident response procedures.
VortexHive provides emergency incident response services and can help you develop robust response plans before incidents occur. Don't wait for an attack to discover gaps in your preparedness. Contact us for a security readiness assessment.
