What to do in the event of a cyber attack

Speed is of the essence if hackers gain access to your charity’s computer systems. For for that reason, it’s important to prepare a plan ahead of time that you can put into action with the minimum of delay.

 

This plan should include the following steps.

 

 

Contain the cyber attack

 

Your most immediate concern when your charity experiences a cyber attack is stop the attack and minimise the damage that it can cause. So the first step should be to disconnect your charity’s network from the internet, cutting off the cyber criminals’ access to your computers and preventing them from exfiltrating any more data.

 

If your computers are infected by ransomware then they may continue to encrypt your data even when they are disconnected from the internet. The best solution if this is the case is to stop your computers running by putting them into hibernation mode, although this mode may not be possible on some desktop PCs.

 

Since the best way to recover from a ransomware attack is to restore data from backups, you should also disconnect any backup devices from  your computers to help ensure that they do not become infected as well.

 

Common mistake to avoid: It may be tempting to turn your computers off, but that can destroy valuable forensic evidence experts might need to work out how your cyber security was breached. Ransomware can also sometimes cause more damage on a computer which is turned off and turned on again than on a computer that is hibernated.

 

 

Change your passwords

 

The next step is to use a computer on a separate network to change the passwords for any cloud services (such as CRM, email, Office 365) that your charity uses, and any other accounts that your employees log on to, as soon as possible. That’s because one or more of these accounts may have been compromised during the cyber attack.

 

Worse, they may have been compromised before the attack, enabling the attack to take place. Failing to change the passwords might mean that the cyber criminals could use information from these accounts to launch another attack once your charity recovers.

 

Common mistake to avoid: Do not reuse the same password for different accounts, as this makes if far easier for cyber criminals if they manage to get hold of it.

 

 

Get the experts in

 

The next thing you need to do is understand how the cyber criminals where able to attack your charity successfully, and what you need to do to fix this vulnerability so that they or any other hackers will be unable to exploit it again.

There are many possible reasons that your charity was vulnerable to an attack.

 

This could include running older, unpatched versions of software, employees inadvertently downloading malware from a phishing email, or someone using an easily-guessable password.

 

In any case, it is likely that you  will need to employ outside experts to get to the bottom of how your charity was attacked, and how to prevent it from happening again.

 

Common mistake to avoid: It can be tempting to try to do this step without outside help. But a “fresh pair of eyes” can often check your systems more thoroughly and discover problems quicker than someone who is too familiar with your computer systems.

 

 

Understand the damage done

 

Perhaps the most important step in this whole process is getting a complete understanding of the impact of the cyber attack. To do this you need to understand what data was accessed, modified, or stolen, who might be affected by this, and what the consequences of this are.

 

Common mistake to avoid: Don’t forget that you also need to understand what other actions the cyber criminals might have taken during their attack, including putting more malware on your systems. If the hackers installed keyloggers on your computers, for example, then as soon as your charity’s computers are reconnected to the internet the hackers will be able to monitor your activities and intercept passwords and other information that you type in.