Lesson 2 of 3
The first hour of an incident
2 min
When you suspect a breach, the first hour decides how bad it gets. Act calmly and in order.
1. Confirm and record
Write down what you saw, when, and who reported it. Start a timeline now; you'll need it later for customers, regulators and your own lessons.
2. Contain, don't destroy
- Isolate the affected server from the network, or restrict its firewall to your admin IP.
- Don't wipe or reboot yet. Memory and running processes hold evidence.
- Take a snapshot or disk image if you can.
3. Cut off access
- Rotate passwords and keys the attacker may have: admin panels, database users, SSH keys, API tokens.
- End all active sessions.
- Check for new users, new SSH keys and new cron jobs; attackers add these to get back in.
4. Communicate
Tell the people who need to know: management, your hosting provider, and, if customer data may be affected, your legal advisor. Many laws set deadlines for notification.
Prepare a one-page plan before you need it: contact list, provider support numbers, where backups are and who can approve taking a service offline.