A company in our sector was hacked. How do we check whether we are next?
Find out how they were attacked, then check that exact path in your own company. Read the public statement, the advisory from your national CSIRTCSIRT: computer security incident response team. The national team to which serious incidents are reported. or sector body, and any reporting that names the method: an exploited VPN or firewall, a shared supplier, phishing, a known ransomware group. Criminal groups often reuse the same vulnerability or the same supplier access against many companies at once, so if you share software or a service provider with the victim, ask the provider directly. Patch the named product, review remote access and supplier accounts, and confirm that your backups are offline and restorable. Then look at your network for the early steps: new outside servers contacted at regular intervals, internal scanning and new administrator sessions. NetSenX flags these on every plan, Free included; it cannot tell you what happens on segments it does not monitor.
Read next
Related questions
- What should we look for on our network after a partner or peer company is breached?
- We had an incident last year. How do we make sure we would detect it if it happened again?
- Why do companies so often learn about a breach from outsiders?
- How do we tell a network attack from a heavy update or backup?
- How do we know what normal looks like on our network?
Terms used here
- CSIRT (computer security incident response team)
- The national team to which serious incidents are reported.