Challenges
Responding to a security incident
A stolen password or a device behaving strangely. The first hour decides how bad it gets: contain it, secure the accounts, recover from clean backups, then close the gap it came through.
The challenge
An invoice email looked right until it did not. A laptop is slow and files have odd names. A supplier says your account sent them something you never wrote. Whatever the first sign, the pattern is the same: isolate what is affected, secure the accounts, recover from clean backups, and find out how it got in.
If it is left
An attacker with a working password or a foothold on one laptop uses the first hours to go further: reading the mailbox for the next invoice to alter, setting a forwarding rule so they keep reading after the password changes, moving to the file server, and encrypting what they can reach. Every hour before containment widens what has to be recovered and what has to be reported. Switching the machine off destroys the evidence of how they got in, which is the thing that stops it happening again.
What good looks like
The affected devices isolated and cleaned, the accounts secured with new passwords and multi-factor authentication enforced, the files and systems the business needs first restored from backups that were taken before the attack, a plain account of what was reached so you can meet your reporting duties, and the gap it came through closed, whether that is email filtering, endpoint protection, training or the controls Cyber Essentials requires.
What to do first
Before you call anyone
Disconnect, do not power off
Unplug the network cable or turn off the Wi-Fi on the affected machine. Leave it switched on: powering off loses the evidence of what happened and how.
Change the password from a different device
If an account is suspected, change its password from a machine you trust and sign out of all sessions. Do it for the Microsoft 365 account first, then anything that shared the password.
Warn the people who might act on it
If a mailbox was compromised, tell finance that no payment or bank-detail change is to be actioned by email until you say so, and tell the suppliers and customers who might receive something from that address.
Write down the timeline
What was seen, by whom, at what time, on which device. The order of events matters for containment, for the insurer and for any report you have to make.
Check your reporting duties
If personal data may have been accessed, the ICO must be told within 72 hours of you becoming aware. Fraud and cyber crime are reported to Action Fraud. Your cyber insurer usually has to be told before any recovery work starts.
Then call
A person answers within three rings. Tell us what you saw and when, unplug the affected device from the network, and do not switch it off until we say so.
What we would do first
-
Call us
A person answers within three rings. Tell us what you saw and when, unplug the affected device from the network, and do not switch it off until we say so.
-
Contain it
Infected devices isolated and cleaned, Microsoft 365 sign-ins checked for account takeover, passwords reset and multi-factor authentication enforced.
-
Recover
Files and systems restored from backup, with recovery times agreed around what matters most to you.
-
Prevent the next one
Email filtering, endpoint and identity protection, security awareness training and Cyber Essentials certification to close the gap it came through.
How we approach it
-
Contain
Affected devices isolated from the network, compromised Microsoft 365 accounts locked, passwords reset, forwarding rules and rogue applications removed from the mailbox, and multi-factor authentication enforced for every user, in that order.
-
Find out how far it went
Sign-in logs, mailbox rules and the endpoint detection and response telemetry show what the attacker reached and when, which tells you what must be recovered and what must be reported.
-
Recover from clean backups
Once the devices are clean, files, mailboxes or whole systems come back from backups taken before the attack, in the order your business needs them, and the restore is checked before people are let back in.
-
Report
A plain written account of what happened, what was reached and what was done, in the form the ICO, your insurer and your customers ask for.
-
Close the gap
The route in gets a control on it: Check Point Harmony Email in front of the mailboxes, Microsoft Defender with Huntress detection and response on every device and identity, awareness training for the people, and the Cyber Essentials controls if a customer or insurer now requires them.
The services that apply
-
Endpoint and identity protection
Containment and investigation run on it: Huntress isolates the device, the identity monitoring shows which sign-ins were the attacker's, and it stays on to catch the next attempt.
-
Backup and recovery
Recovery is only as good as the backup taken before the attack; this is what restores files, mailboxes and systems in the order you need them.
-
Email filtering and cloud protection
Most incidents start with an email that got through; a dedicated layer in front of the mailboxes is the first gap to close.
-
Security awareness training
Short lessons and simulated phishing give the person who clicked, and everyone else, the reflex to stop and check next time.
-
Cyber Essentials consultancy
After an incident, customers and insurers often ask for the certificate; the five controls are also the shortest list of what to fix.
How you would buy it
Every hour we work falls under one of four engagement models. These are the ones that fit this situation; How we work compares all four.
-
01
Consumed
Ad hoc work, no commitment
An incident does not wait for a proposal. For a business without a retainer, the work is charged for the time spent at the list rate for the grade and the time of day, approved as the work unfolds; out of hours is charged at the consumed list rate for every client.
-
02
Fixed price
A defined piece of work or project
Closing the gap afterwards, such as rolling out endpoint protection and multi-factor authentication across the business, is priced as a fixed sum once the incident is over.
-
03
Retainer
The way most of our clients work with us
For a client on a retainer, in-hours containment and recovery are pre-authorised within the retained hours and the cap, so nobody is asking for approval while the clock runs.
Who you would work with
The service desk, first
A trained Odyssey employee in Stockton-on-Tees answers within three rings, takes the timeline and starts containment.
A senior engineer or tech consultant
Leads the investigation and recovery, with the Huntress analysts' findings, and tells you in plain language what was reached.
The Head of Service Delivery
Owns the incident from your side of the desk: what is happening, what is next, and when you can let people back in.
A director
Reachable at any time, including in the middle of an incident.
Further reading
-
Guide
Why smart people still click: the business case for security awareness training
At 16:42 on a Friday, smart loses to tired. Why awareness training matters, and what you get for your money.
Read the guide →
Questions people ask
We are not an Odyssey client. Can you still help?
Yes. Call us and tell us what has happened. We will tell you what to do first on the call, and once a short consumed-time agreement is signed, usually the same day, our engineers start work, charged for the time spent and approved as it unfolds.
What should we do before we call?
Disconnect the affected machine from the network but leave it switched on, change the suspected account's password from a different device, tell finance to hold any payment or bank-detail change, and write down what you saw and when.
Should we pay a ransom?
The NCSC advises against it: paying does not guarantee the files come back and marks you as a business that pays. Recovery from backups taken before the attack is the route, which is why tested backups are the first thing we ask about.
What if someone's Microsoft 365 account has been taken over?
We lock the account, reset the password, remove forwarding rules and rogue applications from the mailbox, check the sign-in logs for what the attacker reached, and enforce multi-factor authentication for every user before anyone signs back in.
Can you restore our files after an attack?
Where backups exist from before the attack, yes. Files and systems are restored once the devices are clean, in the order your business needs them, with the restore checked before people go back in.
Do we have to tell anyone?
If personal data may have been accessed, the ICO must be told within 72 hours of you becoming aware, with a reason if it is later. Fraud and cyber crime are reported to Action Fraud, and your cyber insurer usually has to be told before recovery starts. We give you the written account those reports need.
How do we stop it happening again?
By closing the gap it came through: email filtering, endpoint and identity protection, security awareness training or the Cyber Essentials controls, depending on how it got in. The investigation says which.
How fast will you respond?
A person answers within three rings, and our written minimum is to be actively working within 2 hours on anything urgent. An incident is urgent.
Happening now? Call 01642 661888 and a person answers within three rings
Call and we answer within three rings. Or tell us what you need and we will call you back at any time.