Incident response: what to do in the first hours of a security incident

Every organisation will face a security incident sooner or later: a compromised account, a malware infection, a leaked database, ransomware. What separates a contained incident from a disaster is usually not technology. It is whether people knew what to do.

Before anything happens

• Name an incident lead and a deputy, and make sure everyone knows how to reach them.
• Keep an up-to-date contact list: IT, management, legal, your hosting provider, your insurer.
• Know where your logs are and how long they are kept.
• Have backups that an attacker cannot reach or delete.
• Decide in advance who is allowed to shut systems down.

The first hour: contain

1. Confirm what is happening. Is it an incident, and what is affected?
2. Contain it. Disconnect affected machines from the network, disable compromised accounts, block malicious addresses. Prefer isolating over wiping; evidence matters.
3. Start a timeline. Write down every observation and action with the time. Memory will not be reliable later.
4. Escalate. Bring in the incident lead, and your provider if your infrastructure is hosted.

The next hours: understand and recover

• Preserve evidence: logs, disk snapshots, memory captures where possible.
• Find the entry point. Recovering without closing the door invites a second attack.
• Reset credentials that may be exposed, starting with administrators.
• Restore from known-good backups, then patch before reconnecting.
• Communicate. Decide who needs to know: staff, customers, partners, and any regulator that requires notification within a set time.

Afterwards

Hold a blameless review. Ask what happened, what helped, what slowed you down and what you will change. Then change it.

How IDX helps

IDX SOC services include incident response, and our NOC team monitors the infrastructure we host for you. If you host with us, we can agree in advance how incidents are escalated, who decides on containment, and how we preserve evidence, so the plan exists before you need it.