Investigate

Investigate means establishing the facts about an attack so the organisation knows what has happened and how serious it is.

Investigation establishes four things:

• the nature and type of the attack;
• its severity and the level of risk to the organisation;
• which processes, services or systems are affected and what damage has occurred;
• when the attack happened and how long it may have been going on.

The severity found determines how complex and urgent the response and management should be. A low-severity attack might need a small team and a quick fix, while a severe attack needs urgent, complex action across the organisation. Investigating gives you the facts to match your response to the real risk.

Investigate does not ask how or why the attack happened. Causes and prevention are dealt with in the analyse stage. Investigation is about the current facts: what, how bad, where and when.

A benefit is that the organisation becomes fully aware of the attack's severity and can choose a suitable response, instead of guessing or overreacting.

For example, a small animal rescue charity's donation page is attacked. Investigation finds the attack is an attempt to gain unauthorised access, only the donation page is affected, it began at 9am and the risk is low. The charity can now plan a small, targeted response rather than a costly, organisation-wide one.