actions after an attack

actions after an attack

1. organisations often follow a pre-defined set up of actions after a attack has occurred.

2. after an attack organisations take actions to resolve the situation to reduce the chances of it happening again.

3. the investigation: organisations investigate the nature of the attack.

   • 1)the type of attack (malware, network attack, data theft, ect)
     • 2)the severity of the attack. could be defined as Level 1 (low risk) to level 5 (sever risk)
       • 3)which processes or service in the organisations are affected
         • 4) when it happened.

4. responses on attacks vary depending on the severity of the attack. An organisation will inform stakeholders (employees) if it low risk or the appropriate authorities (law enforcements including the police) if its high risk.

5. the priority is to isolate the problem containing the threat as close to the source as possible. this can be done by disconnection to the infected digital system or blocking unauthorised network traffic by using a firewall.

6. the organisation will have a separate disaster recovery policy that will follow in the event of an attack. it will detail the employees responsible for specific tasks, the expected time line and the remedial action involved

   • longer-term remedial action may include changes to policy, procedures, investments in new hard ware and/or software, increased device hardening or better employee education and training.

7. after recovery has occurred, analysis would focus on the following: what went wrong , how it happened (was it an internal or external threat) how could it have been prevented how effectively the organisation responded to the attack what lessons have been learnt

   • the organisation will most likely update its policies and will make effective changes.