Actions to Take After an Attack

When an attack happens, an organisation follows a clear, predefined set of actions so the situation is resolved and the chance of it happening again is reduced. Planning the steps in advance means nobody has to work out what to do while systems are failing and time is short.

The five actions

The actions are investigate, respond, manage, recover and analyse, usually carried out in that order. Each one has its own purpose, so the work of one stage is not mixed up with another: finding out about the attack is not the same job as reviewing it afterwards, and containing the threat is not the same job as putting data back.

Ready before an attack

The organisation and its employees should understand the actions and their own role in them before an attack occurs. Staff who have already been told what their part is can act straight away instead of waiting for instructions, which shortens the time systems are unavailable. For example, a leisure centre that discovers someone has broken into its online booking system has already agreed who takes the lead, who rings the software supplier and who keeps the rest of the staff informed, so the work begins within minutes rather than after a morning of asking around.

One process, not separate tasks

The five actions fit together as one process, and a full response uses all five. What one stage uncovers shapes what happens at the next, and the lessons from the review at the end feed back into the organisation's policies and procedures. Treating the actions as isolated jobs leaves gaps between them, so part of the job is left undone and the organisation stays exposed to the same attack.

Investigate means establishing the facts about an attack so the organisation knows what has happened and how serious it is.

Investigation establishes four things:

• the nature and type of the attack;
• its severity and the level of risk to the organisation;
• which processes, services or systems are affected and what damage has occurred;
• when the attack happened and how long it may have been going on.

The severity found determines how complex and urgent the response and management should be. A low-severity attack might need a small team and a quick fix, while a severe attack needs urgent, complex action across the organisation. Investigating gives you the facts to match your response to the real risk.

Investigate does not ask how or why the attack happened. Causes and prevention are dealt with in the analyse stage. Investigation is about the current facts: what, how bad, where and when.

A benefit is that the organisation becomes fully aware of the attack's severity and can choose a suitable response, instead of guessing or overreacting.

For example, a small animal rescue charity's donation page is attacked. Investigation finds the attack is an attempt to gain unauthorised access, only the donation page is affected, it began at 9am and the risk is low. The charity can now plan a small, targeted response rather than a costly, organisation-wide one.

Respond is the post-attack action of informing and updating stakeholders and other interested parties about an attack and its progress. Stakeholders are the people or groups with an interest in the organisation, such as its staff, service users or volunteers. The response should vary with the severity of the attack: a minor issue might need only a short internal message, while a serious one may need quick contact with affected people and outside authorities.

For example, a community theatre finds that its booking system has been attacked and customers' names and phone numbers may have been copied. Because personal data may be exposed, the theatre emails affected customers, explains what is known so far and tells them to be wary of unexpected calls or messages asking for money. It also reports the incident to Action Fraud and, where required, to the Information Commissioner's Office. As more information emerges, the theatre posts updates on its website and contacts ticket holders again when it has clearer advice.

Respond includes informing appropriate authorities and law enforcement where the law or the seriousness of the attack requires it. It also means keeping interested parties updated as containment and recovery continue, so nobody is left relying on rumour. Informing stakeholders can damage public image, because it draws attention to the organisation's weakness. However, failing to inform authorities can lead to legal action and fines. The benefit of responding well is that stakeholders and authorities are aware and involved, which supports legal compliance and reduces harm.

Manage means containing an attack as close to its source as possible so that it cannot spread further through the organisation's systems. What the investigation uncovers about the attack's type and the damage it is doing decides how heavy the containment needs to be.

Containing the threat

One way to contain an attack is by disabling a compromised user account — switching off the account being used to break in, so the attacker loses that route. If a college's timetable account starts sending strange messages to staff, disabling it stops the attacker reaching anything else.

Containment can also mean quarantining suspicious files, moving them to a safe holding area where they cannot run or spread. If a dental surgery's reception computer flags an email attachment, quarantining it stops the malicious code opening on other machines.

Another method is isolating affected systems, such as moving a leisure centre's booking server onto its own separate part of the network while it is checked. The organisation can also block unauthorised network traffic, for example blocking all connections from an unknown address that keeps trying to reach a school's network.

The right size of response

Management has to match the attack's type and severity. A single compromised password might only need changing, while an attack spreading between servers may mean shutting down a whole section of the network. Reacting hugely to a small incident wastes time and money; reacting lightly to a serious one lets it spread.

Protecting evidence

Manage also includes protecting and preserving evidence, such as logs, affected devices and copies of suspicious files, because it may be needed for a possible criminal investigation. Evidence is easily destroyed, so devices are left as they were found rather than wiped.

Returning data from a backup belongs to recover, not manage. Restoring old data over live data while the attack is still running would destroy evidence and would not contain the attacker.

The benefit is that the attack is contained and cannot spread, and evidence is preserved for later examination.

Recover is the stage where an organisation puts its disaster recovery plan into action after an attack. The plan is prepared in advance. It sets out who is responsible for each task, the expected timeline for getting things working again and the remedial action required.

Recover covers restoring systems and data, then taking remedial action so the organisation can return to normal operation. A worked example: a small chain of climbing centres finds that its online booking system has been tampered with and some bookings are missing. Its disaster recovery plan names the IT coordinator as the person who restores the booking system and its data from the backup taken at 2am. It gives a five-hour target for the booking system to be available again. The centre manager checks the day's bookings against the restored records, and the finance officer checks payments. These jobs, and their deadlines, come from the plan rather than being invented during the incident.

Recover does not stop at getting back to normal. It also includes longer-term remedial action to reduce the risk of a similar attack happening again. For the climbing centres, that could mean setting the booking system to email the duty manager whenever a booking is edited outside normal opening hours, and adding an audit trail that shows which staff account made each change. Without these changes, restoring the backup would not stop the same problem from happening again.

Recover has a practical advantage: normal work can continue while repairs and security improvements are carried out. The climbing centres can take bookings by phone and at reception while the online system is restored, and the improvements make another long disruption less likely. Recover is therefore more than switching systems back on: it restores service and makes the organisation safer for the future.

Analyse is the final action after an attack. It happens once recovery is complete and systems are working normally again, so the organisation can look back over the whole incident instead of dealing with it live. It reviews the attack after the event rather than identifying the attack while it is still happening.

What analyse looks at

Analyse reviews what went wrong and how the attack happened, including whether the threat was internal (someone inside the organisation, such as a current or former employee or a contractor) or external (an outsider with no legitimate access). It also considers how the attack could have been prevented, and reviews how effectively the organisation responded to and managed the attack: were the right people told in time, and was the threat contained quickly?

Lessons learned

Analyse identifies lessons learned and uses them to update policies, procedures and security measures. Without this step an organisation could fall for exactly the same attack twice.

Why it is worth doing

The benefit of analyse is that it improves future security and sharpens the organisation's response to breaches, because the next incident is handled using tested, updated policies rather than the same gaps.