7 Procedures for recovering from a cyberattack

No business leader likes to imagine worst-case scenario cyberattacks, but as the saying goes, failing to plan is planning to fail. Many cyberattacks and data breaches result in the affected company closing its doors for good or, at best, struggling to repair its damaged reputation and overcome legal sanctions. It doesn’t help that most data breaches aren’t discovered until months after they occur.

Here are seven procedures you should have in place should a cyberattack occur:

#1. Isolate the entry point

The first step is to prevent further damage to your wider network infrastructure. That means you must implement your contingency plan the moment an incident is reported. This requires isolating any systems that have been or may have been affected so that the threat doesn’t spread further. Immediately disconnect any networked devices that have been acting suspiciously, and lock down any online accounts that might have been compromised. Every employee or customer who might have been affected should be alerted to change their login credentials as well.

#2. Determine what was compromised

The next step is to determine the scale of the damage, since this will help you identify the breach notification requirements, if any, that you need to adhere to. To know which data was compromised and how, you’ll need to chart out your connections and trace the attack from the beginning, similar to a spider diagram on a detective’s wall. For example, if email addresses were stolen, you need to find ways to mitigate that, including figuring out how many were stolen, and taking the necessary steps to prevent further damage.

#3. Notify any relevant parties

All organizations are legally required to alert their customers if their personal information has been compromised in a cyberattack. This includes information like login credentials, personally identifiable data, and patient health information. For larger breaches, you may also need to alert the local authorities, while very large incidents may even require alerting a local media outlet. Breach notification requirements vary depending on the regulations your data is subject to.

#4. Validate the integrity of your backups

While not all cyberattacks involve actual damage to or loss of data, there are many, like ransomware, that do. But before you go about restoring any lost data, you’ll also need to verify the integrity of your backups to ensure they haven’t been compromised too. The last thing you want to do is start restoring your backups onto compromised devices before you have a chance to patch any vulnerabilities.

#5. Replace outdated technology

Outdated technology, which is no longer supported by its original developer, presents a huge security risk, simply because there will no longer be any critical security patches for it. You should always manage the full life cycle of all your software and hardware assets to give yourself ample time to make any upgrades or replacements. If you’ve already suffered a data breach, you’ll need to retire any unsupported systems as soon as possible.

#6. Let employees work remotely

With the costs of unscheduled downtime increasing, minimizing disruption to your business is a top priority, provided it doesn’t increase risk when you’re already facing a serious security incident. Having your employees work remotely using their own devices can help reduce disruption while your internal network is cleaned up and any problematic systems are replaced, repaired, or upgraded as needed.

#7. Review your contingency plans

A cyberattack can happen to anyone at any time, and it’s never something you can be 100% prepared for. There will always be room for improvement. That’s why, once you’ve cleared up the mess and taken every possible step to mitigate the damage, it’s a good time to review your contingency plans and make any necessary improvements. A disaster recovery plan is only as effective as it is relevant and up to date, so be sure to rework it to include what you’ve learned from the most recent incident.

Complete Technology provides responsive helpdesk support to small businesses in Kansas City. Call us today to schedule your complimentary consultation.