By the time most organisations call for help, two things have usually happened. Someone has already tried to fix it, destroying evidence. And nobody has decided who is in charge, so decisions are being made by committee in a group chat.
Do not clean up first
The instinct to rebuild a compromised machine is strong and it is usually wrong. The state of that machine is your best evidence of what happened, what was accessed and whether the attacker still has a foothold. Preserve it, isolate it, and investigate before you rebuild.
The first hour, in order
- Declare an incident and name a single incident lead. Authority beats consensus in the first hour.
- Isolate affected systems from the network without powering them off, so memory evidence survives.
- Preserve logs before they rotate. Set retention longer than default immediately.
- Rotate credentials that may be exposed, starting with anything privileged or externally reachable.
- Write down what you know, what you assume and what you have ruled out, with timestamps. Memory is unreliable under stress.
- Notify only the people who need to act. Premature broad communication slows the response.
The part that is decided long before
A response plan, a contact tree that works at three in the morning, and a rehearsal. Organisations that have run one tabletop exercise handle a real incident dramatically better than those that have not, and the difference shows up directly in downtime and cost.
You will not rise to the occasion. You will fall to the level of your rehearsal.
Written by
Samuel Kiyingi
Director of Security, Oasis Hive Limited
