Cyber Security

What to Do After a Cyberattack

4 August 2020

How To Deal With a Cyberattack

With a growing proportion of the global economy and communication moving online, more and more companies are at risk of falling prey to a wide range of cyberattacks. Digital threats like malware, social engineering schemes and phishing scams are responsible for an ever-increasing cybercrime rate.
This makes it crucial for companies of all sizes to have a business disaster recovery plan in place to mitigate and alleviate any losses if such an event occurs. 
Recovering from a cyber security incident can be challenging, especially if you have lost information that was critical to your business operations. The good news is that you can limit the amount of damage to your company by developing a robust IT recovery plan in advance and by testing its effectiveness. 
However, if your business has already fallen victim of a data breach and you need to know what to do after a cyberattack, Redpalm have compiled a list of steps to assist you in minimising and containing the damage.
Let’s take a look at how this can be done.

  • Limit and Control the Extent of the Data Breach

After an attack, the first thing you should do is work out which servers and IT equipment have been compromised. Once you have that information, contain the spread of the breach as swiftly as you can by securing endpoints, devices and servers that aren’t affected by the attack. 
Below, is our list of things you can do to immediately try to contain and limit the spread of the breach:

  • Disconnect your internet connection
  • Restrict remote access
  • Fortify your firewall settings
  • Install any pending security updates or patches
  • Change your passwords across your business network

Once you’re certain you’ve been compromised, isolate any known compromised devices by taking them off your network. However, if you want any forensics performed on them to identify the source of the attack, DO NOT shut them down as most forensic data is lost on system shut down.
Ensure that you create strong new passwords for every affected account immediately. It’s also important that you avoid reusing old passwords or the same password across multiple accounts. This way, if a cyberattack were to happen again in the future, the damage will be restricted to one system or account. 
It is understandable that after a data breach occurs, you’d want to delete all your old records and data. However, we highly recommend preserving the evidence to find out how the breach occurred and understand the weaknesses in your infrastructure.

  • Manage the Fallout by Notifying Employees and Managers

Inform your staff about the cyberattack and define clear authorisations for all team members moving forwards. Ensure that both internal and external business communications are monitored and properly encrypted. 
It is crucial for your business that all the employees and teams remain on the same page as your company recovers from the attack. Depending on the extent of the damage, you may wish to seek legal advice to ascertain if, when and how to inform your customers about the data breach. 
If you have been the victim of a data breach, you need to report it to the ICO within 72 hours of discovery. To find out more about reporting to the ICO, click here.
Moving forwards, we’d suggest implementing routine security checks and evaluating your response to future test cybersecurity incidents, to minimise the likelihood of a similar attack taking place in the future. 
Identify the lessons you have learnt and make adjustments to your security response plan to remain prepared. 

  • Analyse and Evaluate the Breach

If your business is a victim of a wider-reaching cyberattack that has infected several other businesses, ensure that you closely follow any developments and updates on the situation. This way you’ll be kept aware of any additional help that is made available. 
Irrespective of whether you are a part of an extensive network breach or a solitary victim, you will need to assess and evaluate the root cause of the cyberattack. You need to find out its basis and point of origin within your business network so that you can safeguard yourself against a similar attack, should it happen again. 
Ask yourself these questions to thoroughly gauge the extent of the breach:

  • Which employees had access to the compromised servers?
  • Which network connections were being used when the data breach occurred?
  • How was the breach initiated?

Check your security data logs on your antivirus program, email providers or Intrusion Detection System to find out the exact moment the attack was initiated. If you are finding it difficult to pinpoint the origin and scope of the breach, the experts at Redpalm can provide assistance. 
We have a team of qualified cybersecurity professionals who will not only help you recover from the breach but also protect your IT environment from being compromised in the future.

  • Evaluate, Improve and Implement Security Measures

After a cyberattack, it is incredibly important that you update your IT disaster recovery plan, along with your business processes and techniques. This should be tested routinely and rigorously to ensure security and stability. At Redpalm, we conduct these tests in a simulated environment for our cyber security partners to stress test your security processes and ensure your business network is kept as secure as possible from digital threats. 
As a part of your business recovery plan, restoring and backing up of company data should be the obvious next step. As part of our service, we reinstall operating systems on compromised endpoints as we conduct a thorough scan of your IT environment. Our IT solutions come with backup and disaster recovery solutions that will help your business re-establish and manage data backup easily and efficiently with zero downtime. 
At Redpalm, our clients benefit from our comprehensive data protection solutions that ensure the safety and security of their IT infrastructure and equipment including physical workstations, servers and devices.

Get in Touch

Your business cannot predict when, where or how a digital breach will occur but you can take proactive measures to ensure that you are well-prepared if the worst happens. Putting together tried and tested cyber security solutions, as well as a preventative business recovery plan, is the key to protecting your business and to mitigating the impact an incident could have on your business if the worst happens. 
Our managed services provide endpoint security that delivers protection in real-time against email threats, malicious links and malware. Our IT solutions consist of the latest security measures with the best host intrusion prevention applications. 
Cyberattacks tend to put your brand’s credibility on the line and we can help you uphold your reputation with our cybersecurity solutions. If you have been searching for professional IT support and cybersecurity services based in Northampton and operating across the Midlands, then give us a call today!

Latest From The Blogs

cyber security certification UK, two males working on a computer in server room
Uncategorized

5 Tips to Secure Your Cyber Essentials Certification in the UK

According to the 2024 Cyber Security Breaches Survey conducted by the UK government, 50% of UK businesses experienced a cyber attack or security breach in 2023.  With a growing frequency of cyber attacks, many businesses have begun to prioritise cyber security and cyber security certification in the UK.

Read More
cyber security strategy, woman and man working on computers
Uncategorized

How to Build a Strong Cyber Security Strategy

According to cyber security stats, cyber attacks have become more prevalent in recent years, not only increasing in number of incidents but also in their level of sophistication. This increase in ransomware, phishing, and other types of cyber attacks has only emphasised the need and importance of a cyber security strategy for businesses across industries.  An effective cyber security strategy helps you protect your digital assets, such as your systems, networks, and data, from unauthorised access and damage. A well-constructed strategy involves procedures, policies and frameworks to help reduce risks, respond to incidents and safeguard sensitive data.  Your cyber security strategy isn’t meant to be perfect; it’s intended to act as a strongly educated guess as to what you need to do to keep your business safe. As your organisation and the world around you evolve, your strategy needs to evolve as well.

Read More
cyber criminal tactics, two individuals hacking into a computer system
Cyber Security

7 Common Cyber Criminal Tactics to Watch Out For

Cyber crimes are attempts by cyber criminals, hackers or other malicious individuals to gain unauthorised access to a computer network or system. These attacks often target a range of victims, from individual users to organisations and even governments, which begs the question, can cyber crime be curbed?

Read More
improve online security, a person using a laptop with visual of security overlaid on top of image
Cyber Security

6 Simple Ways to Boost Your Company’s Online Security

Online security, aka cyber security, involves protecting your business’s sensitive information and critical systems from unauthorised access and theft. With data networks being almost universal, fraudsters are becoming more and more innovative with their scams. Every day, countless cyber criminals scan unsecured or poorly secured networks, looking for an opportune moment to attack.

Read More
phishing email scam, paper email icon on a hook above a laptop
Cyber Security

A Deep Dive Into HR Phishing Email Scams

Have you ever received an email from your HR team that appeared too good to be true? Or perhaps there was something about it that sounded a little off. Beware—you may have narrowly avoided falling into the clutches of an HR phishing email scam.

Read More
technology as a service, engineer in data center
General

The Benefits of Technology as a Service (TaaS) 

Traditionally, IT infrastructure necessitated a server installed on your business premises to allow access to hardware and software applications. If you wanted to scale your data storage and services, you had to purchase additional hardware or invest in expensive upgrades.

Read More
global IT outage, woman looking stress while computers are showing coding errors
General

A Deep Dive Into Microsoft’s CrowdStrike Global IT Outage

As one of the largest IT outages in history, thousands of businesses and institutions around the world were knocked offline. From airports to healthcare institutes to offices and railways, the Microsoft outage has led to widespread disruptions and delays across the world.

Read More
edge computing, woman inspecting servers
General, Hybrid IT, Managed IT Services

Everything You Need to Know About Edge Computing

Businesses are often overwhelmed with massive floods of data. In fact, large amounts of data can now be collected from sensors and IoT devices present almost anywhere in the world.

Read More
physical security, hologram with pictured graphics symbolising security
Cyber Security

Why Your Business Needs Both Cyber & Physical Security 

As technology continues to advance, organisations are beginning to face increasingly complex security threats, both in the physical and digital world. While physical security and cybersecurity are often treated as separate issues, they are very closely connected.

Read More
future of cloud computing, man using a hologram representation of cloud network
General, Managed IT Services

A Deep Dive Into the Future of Cloud Computing

The cloud significantly disrupted the traditional IT landscape and the momentum of cloud services shows no signs of slowing down. With all this in mind, the future of cloud computing looks bright.

Read More