Guidance that helps small to medium sized organisations prepare their response to and plan their recovery from a cyber incident.
Pages
Page 3 of 7
Step 2: Identify what's happening
How organisations can detect if they're being attacked.
The first step in dealing effectively with an incident involves identifying it. That is, how can you detect that an incident has occurred (or is still happening)?
Find out if you are being (or have been) attacked
Things that might indicate a cyber incident include:
computers running slowly
users being locked out of their accounts
users being unable to access documents
messages demanding a ransom for the release of your files
people informing you of strange emails coming out of your domain
redirected internet searches
requests for unauthorised payments
unusual account activity
Find out what's happened
The following 10 questions can help you identify what has occurred. It's a starting point that you can use to gather vital information as soon as you suspect something has gone wrong. The answers will:
help you provide essential information to your internal or external IT team who will be resolving the problem
form part of your incident review/lessons learnt report
10 crucial questions
What problem has been reported, and by who?
What services, programs and/or hardware aren’t working?
Are there any signs that data has been lost? For example, have you received ransom requests, or has your data been posted on the internet?
What information (if any) has been disclosed to unauthorised parties, deleted or corrupted?
Have your customers noticed any problems? Can they use your services?
Who designed the affected system, and who maintains it?
When did the problem occur or first come to your attention?
What is the scope of the problem, what areas of the organisation are affected?
Have there been any signs as to whether the problem has occurred internally within your organisation or externally through your supply chain?
What is the potential business impact of the incident?
Stop the incident getting any worse
Take a look at your security software (such as antivirus alerts and server/audit logs) to see if you are able to identify the specifics of the attack, and subsequently the cause of the incident. If you are unable to do this (but you know which device has been affected) run your antivirus programme to complete a full scan, and take notes of the results it gives you. If nothing is found, consider using an alternative antivirus programme.
Use the information you have gathered to look for advice online from trusted sources such as police or security websites. You may be able to find instructions there on how to fix the problem.
