Checklist First actions during a cyber incident Isolate, preserve evidence, limit impact and organize the response without making the situation worse. HomeFirst actions during a cyber incidentTopicCybersecurity →⌚ About 1 min read ♡ Add to favorites View my favorites This is a very important part of the work of the United Nations. Cybersecurity Level: Advanced Duration: Immédiat 0 % complete 12 step(s) remaining Quickly qualify the incident Affected systems, start time, symptoms, accounts and data. alerting the decision chain Critical step Directorate, ISD, IRS, Legal, OPD and Insurer by Organization. Isolating compromised equipment Critical step Cut the network without arbitrarily shutting down the systems useful for analysis. Preserving newspapers and evidence Critical step Logs, captures, emails, files, time stampings and actions performed. Block identified indicators Accounts, IP addresses, domains, hashs and temporary rules. Revoking sessions and compromised secrets Critical step Start with the administrative accounts and critical services. Assessing the spread Network, cloud, backups, suppliers and access to the network. Protecting backups Critical step Isolate healthy copies and prevent them from being crushed. Setting up a crisis log Who did what, what time and with what result. Prepare a restoration plan Business priorities, healthy environment and pre-retirement controls. Assess reporting obligations Personal data, authorities, clients, partners and insurer. Organize feedback, experience Causes, deviations, corrective actions and responsible. Intervention notes Copy summary Print / PDF Reset
alerting the decision chain Critical step Directorate, ISD, IRS, Legal, OPD and Insurer by Organization.
Isolating compromised equipment Critical step Cut the network without arbitrarily shutting down the systems useful for analysis.
Preserving newspapers and evidence Critical step Logs, captures, emails, files, time stampings and actions performed.
Revoking sessions and compromised secrets Critical step Start with the administrative accounts and critical services.