Cyber Incident Response

Response

When something has happened, the priorities are containment, understanding, and evidence — in that order, and usually under significant time pressure with incomplete information.

Containment

Stopping the spread without destroying the evidence you will need afterwards. This is a genuine tension and it is handled badly under pressure. Wiping and rebuilding a compromised machine feels decisive and eliminates any prospect of understanding what happened, what was taken, or whether the attacker still has access elsewhere.

Investigation and forensics

Establishing initial access, the timeline, what the attacker touched, whether data was exfiltrated, and whether persistence remains. That last question determines whether you can safely return to operating, and it is the one organisations most often fail to answer before declaring the incident closed.

Recovery

Working with your IT provider on a rebuild sequence that does not restore the attacker along with the data — a real and common outcome when backups predate detection but postdate compromise.

Reporting

Documentation for your board, your insurer, your clients and, where applicable, the ICO. UK GDPR requires notification of qualifying personal data breaches within seventy-two hours of becoming aware, and that clock does not wait for the investigation to finish. A clear factual account of what is known, what is not, and what is being done is worth a great deal in that conversation.

Preparation

Preparation is dramatically cheaper than response and almost nobody buys it until after their first incident.

• Incident response plan — who decides, who calls the insurer, who talks to clients, who has authority to disconnect production. Written down, and available offline for when the network is the thing that is compromised.
• Tabletop exercises — walking your leadership team through a realistic scenario. Consistently surfaces the same gaps: nobody knows the insurer's number, nobody has authority to take systems offline, the contact list is on the file share that is now encrypted.
• Retained response — an agreement in place so that when something happens you are not negotiating terms during the worst week of your year.
• Readiness review — whether you would have the logs, backups and access needed to investigate. Most organisations discover their retention is thirty days after needing ninety.

Working with insurers

If you hold cyber insurance, check the policy now rather than during an incident. Many require you to use a panel provider and may decline costs incurred elsewhere. We will work alongside a panel firm where that is what your policy requires — being straight with you about that is more useful than winning the engagement.

Common questions