An attack on the Internet is no longer an exception for the biggest corporations. Hackers have in recent years targeted small and mid-sized businesses. Why? These businesses do not usually have the well-developed defenses that large businesses possess. Indeed, research has established that almost 60 percent of small businesses collapse after six months of an attack. To the owners and the operators of these businesses, the existence of a breach is grim indeed: losing data and, possibly, the business itself.

That is why the initial 24 hours after a cyberattack are essential. A short window determines how good a business will recover or not recover at all. The post-discovery or gap periods, such as detecting and countering the threat, alerting the stakeholders, and rehabilitating the operations, require speed and accuracy. At Emdee Inc., we specialize in providing IT security management services tailored to the unique needs of small and mid-sized companies. Our comprehensive IT security solutions for small and mid-sized companies are designed not only to help you recover from an attack but to make your business stronger and more secure going forward.

Hour 1–2: Confirm and Contain the Incident

The initial symptoms of a cyber-attack can be extremely dull: one user cannot access their account, the systems are slowing to a standstill, the network traffic starts showing unusual bursts, and one might suddenly receive ransom notes through a system demanding money. As soon as one of these red flags occurs, time begins ticking. The first thing you need to do is ensure that you have had a cyber incident. This needs immediate liaison between your IT team or managed service provider and any of your staff who have witnessed suspicious behaviour.

When this is established, the first concern towards the containment. It is important that you seclude inoculated systems early enough in order to stop the spread. This implies removing the infected devices within the network, stopping shared drives, and deactivating VPN. Systems should not be switched off abruptly, which can eliminate valuable forensic information. Rather, they should be well quarantined, and a record of the activity kept. Emdee Inc. plays a critical role at this point. Our IT security management services include 24/7 monitoring and automated incident detection. With the ability of our systems to isolate compromised endpoints, terminate malicious connections, and initiate a preliminary investigation, we can keep threats contained within our systems before your team gets the time to act with clarity and control.

Hour 3–6: Communicate Internally and Externally

The next thing we are going to do at this stage is to coordinate, communicate, and ensure that the threat is kept at bay as much as possible. This starts on the inside. A small company requires a well-outlined incident response team. Such team members are normally leaders, IT or your MSP, legal counsel, and communications personnel. Every individual must have his/her part understood before an event occurs. Even though you may not have an incident response plan yet, this is a major aspect where Emdee Inc. can assist in developing a response framework in line with your size and structure.

Internally, notify all the employees that the cyber incident is under investigation. Ask them not to use affected systems and to pay special attention to phishing activities. Employees need to be reminded not to delete any files and/or alter them because they may prove important to the process. The communication must be safe; do not use email when you feel that it might have been hacked.

Clients and vendors may have to be informed externally; however should be after getting a better picture of the situation. Communication by messaging should be well-prepared and presented in time, whenever, and in a professional way. 

Hour 6–12: Preserve Evidence and Begin Investigation

The hours that follow are hours of investigation and collection of evidence. One of the most fatal decisions made by many businesses is attempting to rectify things too fast by cleaning systems, reinstalling software, or deleting suspect files. Even though these activities are made with good intentions, they may ruin forensic data, which may be important in determining how the attack occurred and whether or not the attacker has retained access.

Rather, you must look into digital forensics. Take the first step to gather firewall, antivirus, cloud services, and network monitoring logs. Sniff secure copies of the systems that are affected. Find out the accounts accessed during the attack, files accessed, and whether the data was sent out of the organization or not. It is expected to be able to reconstruct the steps of the attacker, define the extent of the breach, and find the remaining threats.

This is where Emdee’s IT security management services prove invaluable. Our forensic professionals obtain and examine evidence with the best-in-class equipment and practices. We guide you on how the breach took place, the vulnerabilities used, and how to seal them. In Emdee, you are not merely reacting, but you have the Ongoing Continuous Learning; in short, you are learning and getting better over time.