Actions to take after an attack

Actions to take after an attack

1. organisations follow a pre-defined set of actions after an attack has occured

2. the investigation

   • 1- type of attack ..
     • for example malware , network attack, data theft, phishing etc
   • 2- severity of the attack
     • this can be from level one at low risk up to level 5 at high risk
       • severe could be a serious breach of data and disruption of surfaces
   • 3- which services in the organisation are affected
   • 4- when it happened

3. response

   • the type of response depends on the severity of the attack the organisation usually inform...
     • stakeholders
       • employees
       • customers
       • business partners
     • authorities
       • law inforcement
       • police
       • national crime agaency

4. how is the response managed?

   • the priority is the isolate the problem to close the source at quickly as possible
   • closing the problem down can be done by disconnecting the system or by blocking unauthorised network traffic by using a firewall
   • the organisations management of the response will be appropriate to the nature of the initial investigation

5. how does the organisation recover?

   • the organisation have a separate recover policy that follow the attack
   • longer term remedial may include changes to policy procedures and new software or hardware. it can also include better education or training of the employee

6. what needs to be analysed?

   • what went wrong
   • how it happened
   • how can it be prevented
   • how effectively the organisation responded to the attack
   • what lessons have been learnt

Images and files in the map