You’ve been hacked! Now what?

Illustration: TBS

In today's digital age, where technology is an integral part of our lives, the threat of cyberattacks is a looming reality. From personal data breaches to large-scale corporate cyber-espionage, no one is truly immune to the potential consequences of a cyberattack. It's not a matter of "if," but "when" you might face a security breach (if you haven't already). So, what should you do when you discover that you have been hacked?

Discovering a security breach can be a stressful experience but it's crucial to stay calm. The first step is to isolate the affected systems to prevent further damage. Disconnect the compromised device from the network to prevent the attacker from gaining further access. 

If it's a corporate network, you might need to disconnect the entire network or specific segments to prevent lateral movement by the attacker and contain the breach. If necessary, power off the compromised device to preserve its current state for forensics analysis. 

Depending on the nature of the breach, it's essential to inform the relevant parties promptly. This may include your IT department, the Information Security Department, and your organisation's incident response team. Notifying upper management, Communication Department and legal counsel is also crucial for a coordinated response. Considering the criticality, you may need to engage qualified cybersecurity professionals or service providers.

Considering the situation, it is important to develop a communication plan. Designate a spokesperson or team responsible for communicating with internal and external stakeholders, including employees, customers and the media. Craft clear and transparent messages that explain the situation, the steps being taken to address the breach and any potential impact on stakeholders. 

Preserve all possible evidence of the breach such as log files, system snapshots and any communication with the attacker. This information can be invaluable for identifying the source of the breach and for potential legal actions or insurance claims. Consult with legal counsel to navigate potential legal consequences, liabilities and obligations stemming from the breach.

It is crucial to determine the extent of the breach. Identify which systems, data or accounts have been compromised. This step is critical for understanding the extent of the breach and its potential consequences. Consider the sensitivity of the data, regulatory requirements and the potential harm to individuals affected by the breach. Understanding the scope is essential for devising a response plan.

After assessing the scope, take steps to contain the breach. This might involve patching vulnerabilities, changing passwords or blocking unauthorised access. Utilise network segmentation to limit lateral movement by the attacker and quarantine compromised systems. The goal is to minimise the damage and prevent further unauthorised access.

If the breach involves personal data or customer information, you may be legally obligated to notify affected parties. Transparency is crucial in maintaining trust. Keep your clients or customers informed about the breach and what steps you're taking to address it.

In the case of a serious cybersecurity incident, it's essential to cooperate with law enforcement, regulatory bodies and relevant authorities. Be prepared to share the evidence you've preserved with law enforcement. They may help investigate the breach and potentially apprehend the attacker.

After containing the breach, focus on remediating the compromised systems. Ensure they are secure before bringing them back online. Implement necessary security updates, reconfigure systems to prevent future vulnerabilities and conduct thorough testing to verify their integrity.

Every cybersecurity incident is an opportunity to learn and improve your security measures. After resolving the breach, conduct a post-incident analysis to identify weaknesses in your security protocols and take steps to prevent future breaches. Document lessons learned and update your incident response plan based on these insights. Revisit and enhance your business continuity plan to better prepare for future incidents and minimise downtime.

To prevent future attacks, invest in proactive cybersecurity measures such as firewalls, advanced malware and virus protection, active directory security, vulnerability management, regular compromise assessment, security monitoring, incident response, employee training, etc. Staying one step ahead of cybercriminals is an ongoing effort. 

Regularly train employees on best practices for maintaining cybersecurity, emphasising each person's role in ensuring a secure environment. Conduct simulated phishing exercises to test and improve employees' ability to identify and report suspicious activities.

Periodically review and update your incident response plan to account for changes in technology, organisational structure and emerging threats. Conduct tabletop exercises to ensure that your team is familiar with the plan and can respond effectively during a real incident.

Evaluate the benefits of cyber insurance to help mitigate the financial impact of a cybersecurity incident. Understand the coverage offered and work with insurance providers to tailor a policy that aligns with your organisation's specific needs.

Cybersecurity is an evolving field and a proactive approach to security is key. Enlist the help of external cybersecurity experts or firms to conduct a thorough investigation, provide expertise and offer recommendations for improving security measures.

Develop a public relations strategy to manage the reputation of your organisation during and after a cybersecurity incident. Reassure stakeholders of the steps being taken to address the breach and prevent future occurrences.

Discovering that you have been hacked is a challenging experience but how you respond to the incident can make all the difference. By staying calm, following a well-defined incident response plan and learning from the breach, you can minimise damage and reduce the risk of future attacks. 

Remember, in the world of cybersecurity, it's not about whether you'll be targeted but how prepared you are to respond when it happens. It is important to regularly update your knowledge, stay informed about the latest threats, and continually assess and improve your cybersecurity measures. 

B M Zahid-ul Haque is a CISO and cyber digital transformation strategist. He can be reached at bmzahidul.haque@gmail.com.

Disclaimer: The views and opinions expressed in this article are those of the author and do not necessarily reflect the opinions and views of The Business Standard.