Part 2: What If We Have Been Attacked!?

As the head of an organization, you’ve just wrapped up a long week of meetings, deadlines, and projects. Earlier in the week, you read our post on Cybersecurity in Rural America: Protecting Your Data and Your Organization- Part 1.  Good information to discuss with the team next week- right?  Well, it’s Friday night, and for now you’re looking forward to relaxing and unwinding after a hectic week. However, just as you’re settling down for the evening, you receive a call from your IT team informing you that your organization has just come under a cyber-attack (or even worse, YOU ARE THE IT TEAM!). Your heart sinks, and your mind races as you try to make sense of what’s happening. You know that you need to act quickly to contain the damage and protect your organization’s sensitive data, but where do you even begin?

Cyber attacks have become an ever-increasing threat to organizations worldwide, and small-town entities are not immune. Dealing with limited resource issues and/ or expertise, they often become the proverbial “sitting duckâ€, mimicking our commonly-seen feathered friends innocently floating the ponds and waterscapes of rural America. All is not lost, however. To be prepared for such an unfortunate event, it is essential for any business to have a solid plan in place to minimize the impact of a successful attack, protect sensitive data, and prevent future incidents.

Simply having an incident response plan is not enough though. It’s important to regularly review and test the plan to ensure its effective and up to date. Without proper testing, the plan may not be able to withstand a real-world attack. Hopefully, the following (8) eight steps will not only provide guidance on how to respond to a cyber-attack, but also the development of your incident response plan.

1. 1. Contain the damage
      Upon discovering an attack on your network, speed is of the essence. Your first goal is to contain the damage by isolating the affected network segments to prevent further spread of the attack. This will prevent the attacker from accessing other parts of your organization’s systems.
   2. Conduct a THOROUGH investigation
      After containing the scope of the attack, it’s critical to conduct a thorough investigation to assess the extent of the damage. This involves identifying the affected systems and data. To ensure a comprehensive analysis of all potential entry points, it’s advisable to have trained personnel with relevant experience in cyber forensics perform the investigation. This will ensure that the evidence is properly collected and preserved, and that all aspects of the attack are thoroughly analyzed. Think of it like a crime scene investigation – every detail matters and a meticulous approach is essential to uncover the full extent of the damage. By doing this, you can better understand the attacker’s methods and motives and develop a plan to prevent future attacks.
   3. Notify relevant stakeholders
      Notify relevant stakeholders, such as customers, clients, employees, and regulatory authorities, as appropriate and in compliance with laws and regulations. This protects sensitive data and prevents further harm. Being transparent will help maintain trust and a positive reputation. Remember, teamwork is key in overcoming challenges and emerging stronger. So speak up and keep everyone informed.
   4. Restore affected systems and data
      Restoring affected systems and data from backups, if available, is another critical step. Hopefully, the IT staff (or you) have taken a serious approach to disaster preparedness have backups of the backups.  In short terms, daily, monthly, onsite and offsite backups are a must- not to mention bare-metal backups (just in case your building itself was, well… destroyed) If data has been lost, the organization should evaluate options for data recovery or reconstruction. It’s essential to ensure that the restored data is also clean and free of malware before reintroducing it to your environment.
   5. Document the TTPs (document what?!)
      You’re getting there!  The next critical step in the process is documentation of the TTPs (“tactics, techniques, and procedures”).  Capturing these details will provide valuable insight into the methods the attacker used to penetrate your network. Having this information can also help serve as evidence to support legal or regulatory requirements, such as when reporting the incident to law enforcement..
   6. Report and comply
      For many organizations there are reporting requirements depending on the type of data involved, the scope of the attack, and the jurisdiction in which your organization exists. Being up front and reporting quickly will also aid in identifying and potentially prosecuting the bad actors. BEFORE reporting however, it is extremely important to get legal advice to make sure that the process is carried out correctly and with the appropriate level of detail..
   7. Assess and improve security
      After the incident has been contained and operations normalized, the organization should conduct an assessment to identify any potential gaps in their security posture that were not identified before the attack. Don’t just check boxes! If your budget allows, consider a red team assessment. This type of assessment will help determine the organization’s ability to detect and respond to another real attack and identify any areas where improvements are needed.  The other benefit to a third-party assessment, is that it will provide an unbiased perspective post-attack security posture. They can also provide assurance to customers, partners, and regulatory agencies that the organization takes security seriously and is taking appropriate measures to protect sensitive data in the future.
   8. Debrief and lessons learned
      Almost done.  As the dust settles and you are closer to getting to spend time with family and friends again, your organization should definitely conduct a debriefing session to gather feedback from all parties involved and evaluate the effectiveness of the incident response plan or the results of not having one. Identify any gaps or areas for improvement and update the incident response plan accordingly. The lessons learned should be used to improve your organization’s security posture and reduce the likelihood of similar incidents occurring in the future.

Falling victim to a cyber-attack can be a stressful experience, just remember to remain calm and be prepared with established incident response procedures to minimize the damage caused by the attack and prevent similar incidents from happening in the future. In the end, the incident had a silver lining. Wait- what?  Yes, if you succeeded in recovering from a cyber-attack. at a minimum, it has likely prompted you and your stakeholders to take proactive steps to improve security measures and better protect your operation.

Now you can finally sit back, kick your feet up, and grab your remote, comfortable that you have done what you can to successfully manage or ward off future attacks.  Wait.  A future attack… what are the chances of that???

For more information or help on securing your organization, contact us at (877) 7GETTRG or [email protected]

credits: AF and AI