What Would Happen to Your Business in the First 24 Hours After a Cyber Attack?

A member of staff can’t access their files. Customers are reporting unusual emails from your company. Your website isn’t responding, or an employee has realised they entered their password into a suspicious website.

What happens next?

Cyber attacks can develop quickly, which means the first few hours following the discovery of an incident can be important.

For Cybersecurity Awareness Month, we’re looking at what businesses may need to consider during the first 24 hours following a suspected cyber attack and why preparing in advance can make a difference.

First: Establish What Has Happened

The first challenge may simply be understanding what you’re dealing with.

A suspicious email doesn’t necessarily mean an entire network has been compromised, while a seemingly minor problem could potentially be part of a wider incident.

Businesses should follow their established incident response procedures and involve the appropriate IT or cyber security specialists as soon as possible.

Information should be recorded as the situation develops, including when the incident was discovered, the systems or accounts potentially affected and the actions that have been taken.

Contain the Incident

Once a cyber incident has been identified, limiting further damage will usually become a priority.

Exactly what this involves will depend on the nature of the attack and should be guided by appropriate technical expertise.

It could include isolating affected devices, securing compromised accounts, resetting passwords or restricting access to certain systems.

Moving too quickly without understanding the incident can potentially create additional problems, which is why having access to appropriate expertise is important.

Activate Your Incident Response Plan

A good incident response plan should establish responsibilities before an attack occurs.

Who has authority to make decisions? Who contacts your IT provider? Who communicates with employees? Who contacts your insurance broker?

There may also be situations where usual communication channels cannot be trusted or accessed, making alternative contact arrangements important.

The National Cyber Security Centre recommends that organisations prepare and practise incident response plans in advance rather than developing them for the first time during an attack.

Contact Your Insurer or Broker

If you have Cyber Insurance, check the notification requirements within your policy and contact your insurer or broker as soon as appropriate.

Some policies may provide access to specialist cyber incident response services, potentially including technical, legal or other professional support.

Following the correct claims and notification process is important. Businesses should avoid assuming that every cost incurred independently following an incident will automatically be covered.

Your broker can help you understand the relevant policy requirements and how the claims process should be approached.

Consider Whether Personal Data Has Been Affected

A cyber attack and a personal data breach are not necessarily the same thing, but a cyber incident may result in personal information being lost, accessed, altered or disclosed.

Businesses should establish what data may have been affected and assess the potential risk to individuals.

Where a personal data breach meets the threshold for reporting, the Information Commissioner’s Office requires organisations to notify it without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

The ICO also requires organisations to keep a record of personal data breaches, including those that do not ultimately require notification.

Think About Business Continuity

While the technical investigation continues, the business still needs to operate.

Could employees work without the affected systems? Can customers still contact you? Are orders, payments or deliveries affected? Is there an alternative way to access essential information?

A cyber incident can quickly become a wider business continuity problem if critical systems are unavailable.

Preparing for this possibility in advance can help organisations identify which systems are essential and how operations could continue temporarily if they were disrupted.

Communicate Carefully

Depending on the incident, employees, customers, suppliers or other stakeholders may need information.

Communication should be accurate and coordinated. At the early stages of an attack, the full circumstances may not yet be understood, so businesses should avoid speculation and work with appropriate technical, legal and communications advisers where necessary.

If individuals are at high risk because of a personal data breach, there may also be specific requirements to inform them.

The First 24 Hours Start Before an Attack

Perhaps the most important lesson is that effective cyber incident response begins long before something goes wrong.

Businesses can prepare by:

Creating and testing an incident response plan
Establishing internal responsibilities
Maintaining appropriate backups
Keeping important contact details accessible
Training employees to report suspicious activity
Understanding data breach reporting responsibilities
Reviewing business continuity arrangements
Reviewing Cyber Insurance and understanding how to notify a claim

An organisation that already knows who to call and what to do is in a stronger position than one making every decision for the first time during an incident.

Is Your Business Prepared?

Cybersecurity Awareness Month provides an opportunity to review not only how your organisation prevents cyber attacks, but how it would respond if one succeeded.

Cyber Insurance can form part of that preparation by providing protection against certain insured losses and, depending on the policy, access to specialist support when an incident occurs.

At W B Baxter, our experienced team can help you review your Cyber Insurance requirements and understand the protection available.

As part of Adler Fairways, we combine W B Baxter’s personal approach with access to wider insurance expertise and markets.

The cover available and policy features will vary between insurers and policy wordings. Specific terms, conditions, limits, exclusions and eligibility criteria apply. Businesses should seek advice regarding their individual requirements.

Cyber Insurance

Ransomeware Cover