After an attack.

After an attack.

1. Action after

   • 1. Investigate
   • 2. Respond
   • 3. Manage
   • 4. Recover
   • 5. Analyse

2. Investigate

   • The organisation will investigate the nature of the attack. It will want to establish:
     • 1. Type of attack
     • 2. Severity of the attack
     • 3. Which processes or services in the organisation are affected
     • 4. When it happened
   • The information gathered at this point is vital to help the organisation determine how to respond, manage and recover from the incident.

3. Response

   • The type of response will vary depending on the severity of the attack.
   • An organisation will typically inform:
     • Appropriate authorities
       • Not telling authorities could lead in legal action and fines.
     • Stakeholders
       • Informing stakeholders can ruin public image.
   • How is it managed
     • The priority is to isolate the problem by containing the threat as close to the source as possible.
     • This can be done by disconnecting an infected digital system from a network or blocking unauthorised network traffic by using firewall.
     • The organisation's management of the response will be appropriate to the nature and severity of the attack as shown by the initial investigate.

4. The recovery

   • The organisation will have separate disaster recovery policy that will follow after an attack.
   • It will detail the employees responsible or specific tasks.
   • In the long term, changes will be made to policy, procedures, investments increased device or better employee training.