What happens during a security incident

A security incident is anything that puts your systems or data at risk: a compromised account, malware on a computer, a lost device with business data on it, ransomware, or a payment made to a fraudster. Our articles on hacked accounts, ransomware and lost devices cover the first minutes of each. This article explains the whole process that follows.

Report it

Call 855-248-2637 and say it is a security incident. For clients on a managed plan this is an emergency and is handled around the clock. Speed matters more than certainty: a false alarm costs a few minutes, while a real incident reported a day late can cost a great deal more. Nobody will be blamed for reporting something that turned out to be nothing.

Contain

Our first job is to stop it spreading: disconnecting an affected computer, signing an account out everywhere and resetting its password and multi-factor methods, blocking a sender, or wiping a lost device. We may ask you to do some of this with us on the phone before we can connect.

Understand

Next we work out what happened: how the attacker got in, what they reached, what was sent or changed, and whether anything else is affected. We look at sign-in logs, mailbox rules, Defender alerts and the monitoring history. We keep evidence rather than cleaning up straight away, because your insurer or the authorities may need it.

Recover

We restore from backups where data was lost or encrypted, rebuild any computer we cannot trust, and confirm systems are clean before reconnecting them. We tell you what is back and what is still being worked on, and you decide when staff can resume.

Who else needs to know

Depending on what was affected, you may have obligations to notify people. Privacy law in your province, state or country may require you to tell the affected individuals and a regulator when personal information has been exposed. Your cyber insurance policy almost certainly requires prompt notice to the insurer. If a fraudulent payment was made, your bank needs to know within hours. Customers or suppliers who received messages from a compromised account should be warned. We help you work out who needs to be told and draft the messages, and we recommend involving your lawyer or privacy advisor for the legal questions.

Review and prevent

Afterwards, we write up what happened, how it got in, what we did and what will stop it happening again, and we go through it with you. Most incidents trace back to one of a handful of causes: a reused password, a missing multi-factor method, an unpatched system or a convincing phishing message. Fixing the cause is the point of the review.