If you think you’ve been hacked, the first step is to isolate affected systems from the network to limit further damage, then contact your IT or security provider immediately. Don’t attempt extensive investigation yourself before containment, as that can worsen the situation.
Contain first, investigate second
If you think you’ve been hacked, the first step is to isolate affected systems from the network to limit further damage, then contact your IT or security provider immediately. It’s important not to attempt extensive investigation yourself before containment. Poking around a compromised system trying to understand what happened can actually worsen the situation, either by tipping off an active attacker or by inadvertently destroying evidence needed for a proper investigation.
Should everything be shut down immediately?
Isolating the affected systems is usually a better approach than a full, indiscriminate shutdown, which risks destroying evidence needed for the investigation that follows. Containment and evidence preservation need to happen together.
Do we need to report this to anyone?
Depending on what data was involved, notification obligations under the Privacy Act’s notifiable data breaches scheme may apply to your business. Get advice on this before hand, since the requirements and timeframes are specific and shouldn’t be guessed at under pressure.
What’s the most common mistake in this situation?
Delaying containment while trying to fully understand the incident first. The right sequence is to contain, then investigate.
Also worth knowing
- Isolate affected systems from the network as the immediate first step.
- Contact your IT or security provider before attempting detailed investigation yourself.
- Preserve evidence rather than immediately wiping or restarting systems.
- Document what you’ve observed and when, for the response process.