Cybersecurity · 8 min
The first hour of an incident
Most of the damage in an incident is done by panic and by destroying evidence.
Confirm before you declare. A noisy alert can be a failed update. A quiet compromise can look like a slow day. Use two sources if you can: identity logs and endpoint or network.
Contain without making the story worse. Isolating a host is often better than powering it off if memory evidence matters. Follow a written playbook, not a group chat.
Communicate on a channel you still trust. If email might be involved, do not use email as the war room. Name who talks to staff, customers and any regulator. One voice.
Preserve evidence: timestamps, images, who touched what. You cannot un-overwrite a log. If you need outside help, they will ask for this first.
Do not 'hack back'. Do not scan random internet addresses. Shefa incident support is defensive and for systems you are authorized to handle.
Write the first-hour sheet before you need it. Consultation can produce that sheet. The night of the incident is a bad time to invent process.