The first hours: step by step
- Isolate. Disconnect infected systems from the network to stop the spread. Do not switch off equipment without thinking: this may destroy evidence.
- Assemble the response team. Roles are assigned in advance: who leads, who handles IT, who handles communications.
- Assess the scope. What is affected, which processes have stopped, whether data has leaked.
- Activate the business continuity plan. Switch critical processes to backup options (see BCP).
- Communications. Agreed messages for customers, partners and employees; notify the regulator if required.
- Recovery. Restore systems from isolated backups in order of priority (see DRP).
- Post-incident review. Causes, lessons and fixes, so that it does not happen again.
What to prepare in advance
- Roles and contacts of the response team (on paper or in a messaging app, available offline).
- Isolated backups and a tested recovery procedure.
- Communication templates for customers and partners.
- Exercises based on a ransomware scenario (see exercises).
The first 60 minutes: what to do and what not to do
The first hour determines how long the stoppage will last. In this time you deal with four tasks, and their order matters.
- Stop the spread. Disconnecting a network segment is almost always cheaper than having two more servers encrypted. The person on duty must be given the right to do this in advance, in writing.
- Assemble the crisis team. Four roles are enough, and a twenty-person meeting is not needed. The roles: who decides, who talks to IT, who speaks to the outside world, who keeps the event log.
- Start a log. Time, action, who did it. Later the insurer, the regulator and the internal review will all need it. It cannot be reconstructed from memory.
- Assess the scope first. Which processes have stopped, what that costs per hour, what is critical to bring back first. Investigating the cause comes later.
What not to do in the first hour: do not look for someone to blame, do not talk to the press without a prepared statement, do not restore from a backup until you know whether the backup itself is infected, and do not pay a ransom on impulse. A detailed analysis of a ransomware attack is in ransomware protection.
Who speaks to the outside world
The market reads silence in the first hours as a loss of control, and a hasty statement with wrong figures has to be retracted. So one appointed person speaks to the outside world, and speaks from a prepared text.
The prepared text is written in advance, in calm times, separately for employees, customers, partners and, if needed, the regulator. It states the fact of the incident, what is known so far, what is being done and when the next update will come. A promised recovery time that is later missed does more harm than the incident itself. For a detailed guide with examples, see crisis communications.
Notifying the regulator about a personal data leak is a separate question: deadlines and obligations are covered in BCM and data protection. Why companies delay disclosure and what it leads to is covered in why companies hide cyberattacks.
Decisions to make before the attack starts
In a crisis, you do not make decisions that could have been made in advance. Decide in advance: who has the right to disconnect the network and stop production, which channel the crisis team uses if corporate email is down, where the contacts of key people are kept outside work systems, and which processes are restored first and in what order.
The last point comes from the business impact analysis; the rest belongs in the crisis plan. There is only one way to test all of this: cyber exercises, a tabletop rehearsal of an attack. A real example of what unpreparedness costs: seven days of downtime after a cyberattack.
You can test these decisions before an attack in five weeks: the ransomware readiness check shows how the company would work without ERP and CRM and what one day of downtime costs.
Frequently asked questions
What is the very first thing to do in an attack?
Isolate infected systems from the network to stop the spread, and assemble the response team appointed in advance. Do not switch off equipment without thinking: you may destroy evidence.
Should you pay the extortionists for decryption?
As a rule, no. Payment does not guarantee recovery and encourages new attacks. Rely on isolated backups and the recovery plan.
Do you have to report an attack?
For some organisations and types of data, notifying the regulator is required by law. Even when you could formally stay silent, analysing the causes matters more than concealment.
Is your team ready for the first hour of a crisis?
You test a plan by running a scenario. Reading it is not enough. The assessment shows the gaps, and the corporate format works through them with your team on your own processes.
Crisis and cyber threats
This is the core page of the section. Below are the other materials in the section. They cover specific parts of the topic.
- Ransomware protectionIsolated backups, recovery plan, rehearsal
- Cyberattack protectionReduce the likelihood of an attack and survive one that gets through
- 7 days of downtime: lessons from a cyberattackA real case: a week of downtime at a large insurer
- Cyberattacks on SMEs: statisticsRecent statistics on attacks against Russian businesses
- Why companies hide cyberattacksWhy incidents are disguised as “scheduled maintenance”
- BCM and data protectionFederal Law No. 152-FZ, leaks and turnover-based fines
- Cyber exercisesA tabletop rehearsal of an attack: a 72-hour scenario, roles, metrics
- Crisis communicationsWhat to tell employees, customers and the media in the first hours
- Employee cybersecurity training: what works and what is missingPhishing simulations and what is really worth teaching
- Crisis planCrisis team, the first 24 hours, communications and drills in seven steps
- BCM and information security (in Russian)Where the roles end, where they overlap, and three typical imbalances