Insights / Article / Cybersecurity and IT resilience
ArticleIncident response in the first hour
What you do in the first hour of a cyber incident often decides the size of the damage. Contain, communicate and follow a plan you have already rehearsed.
The first sign of a serious cyber incident is rarely dramatic. A user reports that files will not open and their names have changed. The finance team notices a payment they did not authorise. A monitoring alert flags an administrator account logging in from an unfamiliar country at four in the morning. Someone has to decide, quickly, what this is and what to do.
What you do in the first hour often decides the size of the damage. Act decisively and an attack can be confined to a few machines. Hesitate, or act in the wrong order, and it can spread across the network, destroy evidence and turn a bad day into weeks of disruption. The organisations that handle this well are not the ones with the most expensive tools. They are the ones that decided in advance who does what.
Minute zero: recognise and declare
The first decision is to treat the event as a possible incident rather than a routine fault. That sounds obvious, but many incidents grow while people try to fix what they assume is an ordinary IT problem.
- Agree in advance what triggers an incident declaration: signs of ransomware, unauthorised access, unexpected data transfers or fraudulent payments.
- Give the service desk and IT team clear authority to declare an incident and call the incident lead without seeking permission.
- Start a written log immediately, with times, observations and decisions. It will matter later for insurers, regulators and the review.
Contain
Isolate affected systems and preserve evidence. The aim of containment is to stop the problem spreading while keeping the information needed to understand what happened.
- Disconnect affected devices from the network, by unplugging the cable or disabling wireless, rather than switching them off. Powering down can destroy evidence held in memory.
- Disable or reset compromised accounts, starting with any administrator accounts involved.
- Block suspicious connections at the firewall if the source or destination is known.
- If ransomware is spreading, consider isolating whole network segments or sites, and protect backup systems by disconnecting them.
- Photograph screens showing ransom notes or error messages, and record what you see.
Do not wipe and rebuild yet
The instinct to restore from backup immediately is strong. Resist it until you understand how the attacker got in. Restoring onto a network that is still compromised can mean being attacked again within hours, and wiping machines removes evidence you may need.
Common first-hour mistakes
- Carrying on as normal in the hope the problem is minor, while the attacker continues to move through the network.
- Discussing the incident by email on a system that may be compromised, so the attacker can read the response.
- Several people taking separate actions without telling each other, which confuses the picture and destroys evidence.
- Contacting the attacker or replying to ransom notes before taking specialist advice.
- Waiting for certainty before calling the insurer or IT provider, and losing hours that cannot be recovered.
Communicate
Inform the right people with clear, factual updates. Silence breeds rumour, and rumour leads people to take actions of their own that make things worse.
- Internally: tell the leadership team what is known, what is not yet known and what is being done. Tell staff what they should and should not do, such as not logging in or not opening certain files.
- Specialists: call your IT provider, your cyber insurer’s incident line and, if needed, an incident response firm. Insurers often require early notification and may appoint specialists.
- Banks: if payments may be involved, contact the bank immediately; speed can make the difference in recovering funds.
- Regulators and customers: if personal data may be affected, note the time you became aware. Data protection rules may set short deadlines for notification, so take advice early.
Use communication channels that do not depend on systems that may be compromised. If email is affected, have an agreed alternative, such as phone numbers on paper or a separate messaging group set up for this purpose.
Keep updates short and factual. State what has happened, what is affected, what people should do and when the next update will come. Avoid speculation about causes or culprits; early theories are often wrong, and they travel faster than corrections.
Follow the plan
A rehearsed plan with named roles beats improvisation. In the first hour, people are anxious and information is incomplete. A plan removes dozens of small decisions and lets the team focus on the ones that matter.
- Incident lead: coordinates the response and makes operational decisions.
- Technical lead: directs containment and investigation, internal or from the IT provider.
- Communications lead: handles messages to staff, customers and, if needed, the media.
- Executive decision-maker: authorises significant business decisions, such as shutting down operations or engaging external specialists.
- Scribe: keeps the log of times, actions and decisions.
Consider a typical regional manufacturer that rehearsed its plan in a two-hour tabletop exercise six months earlier. When ransomware appears on a handful of office machines on a Monday morning, the service desk declares an incident within minutes, the technical lead isolates the office network from the production network and the insurer’s helpline is called within the hour. Production keeps running. The exercise had revealed that nobody knew how to separate the two networks quickly; fixing that was the most valuable outcome.
Prepare before you need it
Write a short incident plan, no more than a few pages, with the roles, contact details and first steps above. Print it and store copies where they can be reached if systems are down. Then run a tabletop exercise: gather the people named, walk through a realistic scenario and note where the plan is unclear. An afternoon spent now will make the first hour of a real incident far calmer.
Keep the plan alive. Review it whenever key people change, after any significant change to systems or suppliers and after every real incident or exercise. Check that phone numbers still work and that the people named still know their roles. A plan with out-of-date contacts can cost the very minutes it was written to save.
Source: Intelliversal analysis.
