Actions to Take After an Attack
Analyse
Analyse is the final action after an attack. It happens once recovery is complete and systems are working normally again, so the organisation can look back over the whole incident instead of dealing with it live. It reviews the attack after the event rather than identifying the attack while it is still happening.
What analyse looks at
Analyse reviews what went wrong and how the attack happened, including whether the threat was internal (someone inside the organisation, such as a current or former employee or a contractor) or external (an outsider with no legitimate access). It also considers how the attack could have been prevented, and reviews how effectively the organisation responded to and managed the attack: were the right people told in time, and was the threat contained quickly?
Lessons learned
Analyse identifies lessons learned and uses them to update policies, procedures and security measures. Without this step an organisation could fall for exactly the same attack twice.
| Question analyse asks | What the review found | Change made |
|---|---|---|
| How did it happen? | A login belonging to a swimming coach who left last term still worked | Leavers' accounts are now disabled on their last working day |
| Could it have been prevented? | Nobody checked which accounts were still active | A termly account audit is added to the IT procedure |
| How well did we respond and manage it? | The affected computer was isolated the same morning, but members were told four days later | A named person must send members an update within 24 hours |
Why it is worth doing
The benefit of analyse is that it improves future security and sharpens the organisation's response to breaches, because the next incident is handled using tested, updated policies rather than the same gaps.
Practise this
Pearson BTEC Digital Information Technology · Actions to take after an attack