Actions to Take After an Attack
Post-attack actions
When an attack happens, an organisation follows a clear, predefined set of actions so the situation is resolved and the chance of it happening again is reduced. Planning the steps in advance means nobody has to work out what to do while systems are failing and time is short.
The five actions
The actions are investigate, respond, manage, recover and analyse, usually carried out in that order. Each one has its own purpose, so the work of one stage is not mixed up with another: finding out about the attack is not the same job as reviewing it afterwards, and containing the threat is not the same job as putting data back.
| Action | Its own purpose |
|---|---|
| Investigate | Establish the nature and severity of the attack and what it affected. |
| Respond | Inform and update stakeholders and the appropriate authorities. |
| Manage | Contain the threat, using procedures suited to the attack's nature and severity. |
| Recover | Carry out the disaster recovery plan and take remedial action. |
| Analyse | Update policy and procedures so the organisation learns from the attack. |
Ready before an attack
The organisation and its employees should understand the actions and their own role in them before an attack occurs. Staff who have already been told what their part is can act straight away instead of waiting for instructions, which shortens the time systems are unavailable. For example, a leisure centre that discovers someone has broken into its online booking system has already agreed who takes the lead, who rings the software supplier and who keeps the rest of the staff informed, so the work begins within minutes rather than after a morning of asking around.
One process, not separate tasks
The five actions fit together as one process, and a full response uses all five. What one stage uncovers shapes what happens at the next, and the lessons from the review at the end feed back into the organisation's policies and procedures. Treating the actions as isolated jobs leaves gaps between them, so part of the job is left undone and the organisation stays exposed to the same attack.
Practise this
Pearson BTEC Digital Information Technology · Actions to take after an attack