Incident Response Cheat Sheet by TheMadAdmin (AKA Dave)

Step 1: Don’t Panic

• Stay calm and adopt a problem-solving attitude. This will help you and your team respond logically and effectively to the breach.

Step 2: Do Not Pay a Ransom

• Paying ransom often leads to more trouble. Invest in an Endpoint Detection and Response solution to handle ransomware before it executes.

Step 3: Form a Response Team

• Assemble a capable response team including IT staff, HR, and PR. They will investigate, address the breach, and manage communications.

Step 4: Use Backup Servers

• If available, switch to backup servers to maintain operations. Ensure your backups are tested regularly.

Step 5: Isolate the Breach

• Minimize the number of affected systems by isolating the breached area. Test other network segments to ensure they are secure.

Step 6: Investigate & Manage

• Investigate the breach to understand the damage. Address any impacts, especially on employees and your company’s reputation.

Step 7: Document

• Document the breach and your response thoroughly. This helps in refining your response strategy and future prevention.

Step 8: Contact Clients

• Notify affected clients promptly and provide them with necessary information, especially if their private data was compromised.

Step 9: Prevent Future Attacks

• Consider partnering with an external cybersecurity firm if your team struggles with securing your IT infrastructure. Managed Security Services Providers (MSSPs) can be more efficient.

Important Contact Information:

• IT Contact: For remediation efforts
• Legal Counsel: For breach notification and reporting
• PR Contact: For client notifications
• HR Contact: For employee impacts
• Local Law Enforcement: May be needed for insurance claims
• FBI Field Office: www.fbi.gov – Report cyber crimes

Why You Need an Incident Response Policy

Having a written Incident Response policy is crucial as it ensures your organization is prepared for cybersecurity incidents. This policy:

• Provides clear steps to manage and mitigate breaches, minimizing damage.
• Ensures all team members understand their roles and responsibilities.
• Helps maintain client trust by demonstrating a proactive approach to security.
• Assists in regulatory compliance and reduces potential legal liabilities.

Prepared by: TheMadAdmin (AKA Dave)

Having a well-documented policy helps your team stay organized and effective during a crisis, ensuring a swift and controlled response.