1. Remain calm and assess the situation.

 Remaining calm and assessing the situation is important in order to make rational decisions and respond effectively to the attack. This step involves identifying the scope of the attack and what systems or data may be impacted.

2. Disconnect from the network immediately to prevent further damage.

 Disconnecting from the network immediately can help prevent further damage and spread of the attack. This step is crucial in containing the damage and minimizing the impact of the attack.

3. Identify the type of attack and gather evidence.

 Identifying the type of attack and gathering evidence helps determine the cause of the attack and the method used by the attacker. This information is necessary for effective incident response and future prevention efforts.

4. Notify the relevant departments, such as IT and legal.

 Notifying relevant departments, such as IT and legal, ensures that all necessary resources are brought to bear in addressing the attack. IT can provide technical support, while legal can advise on any legal obligations or potential liabilities. 

5. Isolate affected systems and preserve them for forensic analysis.

    Isolating affected systems and preserving them for forensic analysis helps preserve evidence for later investigation. This step is critical for determining the cause of the attack and any potential consequences.

6. Implement incident response procedures.

    Implementing incident response procedures helps ensure a systematic and effective response to the attack. This step involves following established procedures for responding to a cyber attack, which can help minimize damage and recovery time.

7. Change all passwords, especially those of privileged accounts.

 Changing all passwords, especially those of privileged accounts, helps prevent attackers from accessing sensitive information. This step is important in ensuring that the attacker no longer has access to the network or data.

8. Update all software and security systems with the latest patches.

   Updating all software and security systems with the latest patches helps address any vulnerabilities that may have been exploited by the attacker. This step is critical in ensuring that the network and systems are secure against future attacks.

9. Check if backups are working and test the ability to restore them.

  Checking if backups are working and testing the ability to restore them helps ensure that important data can be recovered in the event of a successful attack. This step is essential for minimizing data loss and ensuring business continuity.

10. Notify customers and stakeholders if sensitive information has been exposed.

  Notifying customers and stakeholders if sensitive information has been exposed is important for maintaining transparency and trust. This step is necessary in meeting any legal obligations and preventing reputational damage.

11. Work with law enforcement, if necessary.

  Working with law enforcement, if necessary, can help bring the attacker to justice and provide additional resources for investigating the attack.

12. Consider using professional incident response services.

 Considering using professional incident response services can bring in experts with the necessary skills and experience to effectively respond to the attack. This step can help minimize damage and recovery time. 

13. Develop a plan to prevent future attacks.

 Developing a plan to prevent future attacks helps ensure that the organization is better prepared to defend against future attacks. This step involves analyzing the cause of the attack and identifying areas for improvement. 

14. Conduct a thorough post-incident review.

  Conducting a thorough post-incident review helps identify areas for improvement and ensure that lessons learned from the attack are incorporated into future incident response plans.

15. Educate employees about cyber security best practices.

    Educating employees about cyber security best practices helps ensure that all members of the organization are aware of the risks and how to protect against them.

16. Update incident response plans and procedures.

 Updating incident response plans and procedures helps ensure that the organization is prepared to respond to future attacks. This step involves incorporating lessons learned from the current attack and any changes to the threat landscape. 

17. Check for new vulnerabilities and potential targets.

  Checking for new vulnerabilities and potential targets helps identify any weaknesses in the network and systems that may be exploited by attackers. This step is essential for proactive defense against future attacks.

18. Monitor systems for any unusual activities.

 Monitoring systems for any unusual activities helps detect any potential attacks early and respond quickly. This step is critical for minimizing damage and ensuring business continuity.

19. Continuously test and improve security systems.

 Continuously testing and improving security systems helps ensure that the network and systems remain secure against evolving threats. 

20.  Stay informed about current and emerging threats.

  Staying informed about current and emerging threats helps ensure that the organization is prepared to defend against new and evolving threats. This step involves staying up-to-date with the latest developments in cyber security.

Hans J Petersen