What should we avoid doing during a cyber incident?
A short list of common mistakes. Do not wipe or rebuild machines before evidence is saved, or you lose the means of finding out how the attacker got in. Do not reset passwords one by one while the attacker is still watching; plan containment and do it in one go. Do not discuss the incident over e-mail or chat that may be compromised. Do not contact or pay the attackers without advice from your responder, insurer and lawyer. Do not restore from backups before you know they predate the intrusion. Do not announce publicly what you do not yet know, and do not promise customers that no data was affected before you have checked. Do not miss deadlines: a NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. early warning or a GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). notification can be sent with incomplete facts and completed later. And do not stop watching the network once systems are back.
Read next
Related questions
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).