The response and recovery after a cyber attack must be a joint effort between the IT and Operations departments. When we asked over 120 IT leaders, “Cyber attacks on my organisation are an issue because…” their view was that disruption to operations was the most significant issue (42%). So it appears IT and Operations can agree on the damage.
The role of the Operations Manager typically includes staff training which can consist of post-attack cyber awareness. In addition, they will be responsible for providing continued service and reassurance to customers and managing the impact on compliance.
That’s a lot of responsibility. To help, we have identified 10 procedures to follow in the clean-up after a cyber incident.
The first step in the recovery process is to isolate the affected systems to prevent the attack from spreading to other parts of the network.
Once the systems have been isolated, the IT team should identify the scope and impact of the attack. This will help them understand the extent of the damage and determine the appropriate course of action and identify any data that has been compromised.
It is essential to determine the cause of the attack to prevent similar attacks in the future. This will involve conducting a thorough investigation of the affected systems to identify any vulnerabilities that were exploited.
The IT team will need to remove any malware or other malicious software installed during the attack.
The operations team should report the attack to the relevant authorities, such as the local police, cybercrime agencies, and the Information Commissioner’s Office.
There is a legal responsibility under UK data laws to report any data breach within 72 hours of it being discovered. More details at UK GDPR data breach reporting (DPA 2018).
The operations manager should communicate with clients and customers, informing them of the breach and any potential impact on their personal data.
Once the malware has been removed, the IT team will need to restore any data and systems affected by the attack.
Finally, the IT team should implement security measures to prevent future attacks. This may include updating software, installing security patches or additional firewalls and implementing new security protocols.
Consider conducting regular security audits to identify any vulnerabilities and take action to mitigate them.
Regular cybersecurity training should already be part of an organisation’s defence. Don’t just train them during their induction and then forget it. Cyber attacks constantly evolve, and employees and contractors must know best practices to prevent future breaches.
In summary, recovering from a cyber attack requires a multifaceted approach that requires cooperation between IT and Operations. The team must assess the damage, isolate infected systems, strengthen security, train staff, and inform customers and the authorities. Early warning of attacks and fast response is essential, and cybersecurity training needs to be engaging and up-to-date.