UNDER ATTACK?
Dealing with an incident right now? Call us.
Tell whoever answers it's an incident.
The first hour
Do
- Disconnect affected machines from the network, but leave them powered on.
- Call your cyber insurer's hotline.
- Write down what you saw and when.
- Use a phone or a clean device to communicate.
Don't
- Wipe or rebuild machines yet.
- Pay a ransom or reply to the attacker.
- Email about the incident from accounts that may be compromised.
When you call, we'll ask
- What you saw, and when
- Which systems are affected
- Whether you have cyber insurance
- Who in your company can make decisions
Not urgent? Rehearse with a tabletop exercise or talk to a Principal Engineer.