Recovering from a cyber attack

The National Cyber Security Centre (NCSC) have new response and recovery guidance that can provide a framework for dealing with a highly disruptive cyber incident and its aftermath.

Anyone who has experienced a cyber-attack in their business will know that there is an emotional toll in addition to recovery work that can take weeks or even months.

The NCSC guidance is divided into three sections, and considers:

• The immediate activities that should be undertaken in the first few hours of an incident happening.
• How to set up and run a recovery programme and its supporting activities during the first few days, and potentially weeks.
• The organisational rebuild phase as the business begins to recover its processes and get back to business as usual.

Immediate activities

The guidance emphasises the key role of leaders in setting a calm, professional tone from the outset. While the first response is often highly emotional, maintaining composure and focus will improve decision making and reduce how much leverage an attacker can exert.

Recommended actions for the first hours after an attack include:

• Establish an incident command structure.
• Secure the services of an NCSC-assured cyber incident response (CIT) provider.
• Decide whether to disconnect or shut down systems.
• Incident triage: establishing the current operational state.
• Identify and complete any immediate regulatory or other requirements.
• Report the incident to the NCSC.
• Establish a central record to log and share situational awareness.
• Establish communications with key stakeholders.

Recovery and ongoing investigations

Once confident that the attacker has been evicted from the network, the recovery process can start. The NCSC guidance warns that this can take longer than expected.

It is recommended that recovery is run as a formal programme, with clear structure, ownership and decision-making authority. The guidance sets out what this can look like.

Rebuild

As a business moves beyond crisis response and business gets back to normal, the rebuild phase is about strengthening the business so it is better prepared for the future.

Because cyber incidents can place heavy demands on people, it is also important to provide the staff involved with time and support so that they can recover.

The guidance provides ideas on what business leaders can do and the areas that may need attention.

To review the guidance in full, see: https://www.ncsc.gov.uk/collection/what-to-do-when-cyber-attacks-disrupt-your-organisation/recovering 

Looking for advice? Check out our full range of services. From payroll help to taxation advice, our expert team is available to lend a hand.