After a Cyberattack
This blog post is the sixth and final entry of a six-part series discussing the best practices relating to cyber security. The previous post discussed the individuals and organizations that should be notified once a cyberattack occurs. This post will focus on what a business should not do after a cyberattack. Key points include (1) not using the network, (2) not sharing information with unconfirmed parties, and (3) not attempting to retaliate against a different network.
Do Not Search Through the Network
Once a cyberattack has been identified, most individuals may feel compelled to immediately examine their network and search through all of their system's files. This sudden reaction can cause further damage and may result in a total system failure. Some hackers rely on the natural inclination to examine a network in order to cause more destruction. They may install dormant malware that is triggered after an authorized user accesses the network to survey the damage. If the hackers are monitoring the network after the attack, they may also be able to steal additional information such as passwords and usernames if individuals attempt to log on.
The better option is to immediately suspend all use of the network and commence the action plan. By limiting network activity, a business may be able to contain the attack and safeguard unaffected systems. Furthermore, suspending the network will help preserve evidence of the attack for law enforcement officials. As a last resort, a business should be prepared to shut its entire system down in order to contain the attack if it is still active.
Do Not Release Information to Unconfirmed Parties
After a cyberattack, a business should be very careful to only communicate information to credible sources. Some hackers will pose as law enforcement officials and send inquiring messages to the business after the attack. These messages are sent in an attempt to gain information from the business. The hackers may use this information to launch a second cyberattack on the already damaged network. All communication should be via the telephone or in person if possible. It is important that a business designate one individual to communicate on behalf of the business. This individual should not share information with anyone until he or she has confirmed the identity of the other party.
Do Not Attempt to Retaliate Against Other Networks
If a business is able to determine the source of the cyberattack, it may be tempted to retaliate with cyber warfare against the source. Not only is this tactic illegal under U.S. and foreign cybersecurity laws, but it may also cause further damage to a business' system or provoke a second attack. Additionally, many cyberattacks originate from innocent networks that have previously been hacked. Retaliation against these networks would only hurt a previous victim and would not impact the hackers. Remaining calm and following the action plan is always the best course of action after a business has been impacted by a cyberattack.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
