How to prepare for and plan your organisation's response to severe cyber threat: a guide for CNI
Act now to be ready to withstand and recover from severe cyber attacks.
Pages
Page 17 of 26
3.4 Document and rehearse defensive actions
It’s vital to document and rehearse all the defensive measures you can implement quickly – without risk of inadvertently blocking access to critical functions – in the event of an escalation in cyber threat.
Defensive action
How to implement
Invalidate existing credentials.
To prevent attackers using previously compromised credentials:
Force organisation-wide password resets.
Rotate authentication tokens.
Revoke access certificates.
Restore systems from trusted backups.
Identify which systems can be built from known good backups.
Ensure backups are stored securely and tested regularly so they can be deployed rapidly.
Establish a network isolation plan.
Plan how to segment or island critical systems to contain threats.
For organisations with OT, ensure you can:
maintain essential operations even when IT systems are disrupted or isolated.
Establish alternative processes for critical business functions.
Develop workarounds that can operate if primary systems are unavailable. This might include:
manual processes
alternative communication channels
backup operational procedures
Factory reset devices.
Plan for comprehensive device resets to remove persistent threats. Following any device reset, ensure device activity is monitored to confirm it is functioning as expected. If it is not you may need to replace the device. Sophisticated attacks may be able to survive device reset or intentionally destroy the device, such as by wiping firmware.
Document which devices can be reset and how quickly they can be restored to operation.
Plan for the ability to rebuild network from scratch.
In some circumstances the only option may be to build entire sections or whole networks from scratch.
Document and rehearse if this is possible for your organisation.
Evict adversaries from your network.
The Cybersecurity and Infrastructure Agency (CISA) Eviction Strategies Tool provides actionable, risk-aware playbooks to rapidly contain and remove advanced threats from the network while preserving resilience.
