Friday, 4.45 in the afternoon
You work on the IT help desk of a recruitment firm. A colleague rings: she clicked a link in an email, typed her password, and now her mailbox is sending messages she never wrote.
It is nearly the weekend. What you do in the next ten minutes matters more than anything you do on Monday.
By the end of this lesson
Note
I can say the first steps after a security incident.
Key words
| Word | What it means |
|---|---|
| Incident | an event that harms or may harm security |
| Report | to tell the right person straight away |
| Contain | to stop the harm from spreading |
| Evidence | records that show what happened |
| Log | a file where a system writes what it did, with times |
The cells students fill in are left blank in this preview.
Report it first, and report it fast
The first step is to report the incident to the right person. Every firm has one: a security team, an IT manager, or an on-call number.
Report it even if you are not sure, and even if it was your own mistake. A fast report saves hours of damage. A hidden one can cost the firm its customers.
Say what you saw, when, and what you have done so far.
Contain it, and keep the evidence
To contain an incident is to stop it spreading. Reset the stolen password. Sign the account out everywhere. Take an infected laptop off the network.
Do not wipe or switch off machines unless the team says so. They hold evidence of what happened, and the team needs it to find out how far the harm went.
Worked example: contain without destroying
| What happened | Contain it by | Do not |
|---|---|---|
| A password was typed into a fake page | Reset it and sign out every session | Delete the email |
| A laptop shows a ransom note | Unplug its network cable or turn off Wi-Fi | Wipe the laptop |
| A key was pushed to a public site | Cancel the key and make a new one | Only delete the line |
The cells students fill in are left blank in this preview.
A common mistake
Warning
Many people think the best fix is to wipe the machine at once. Wiping removes the harm on that machine, but it also removes the evidence. Contain first and keep the machine as it is, because the team must learn what else was touched.
Logs show what happened and when
A log is a file where a system writes what it did, one line per event, with the time.
After an incident, the team reads the logs. Many failed logins in a row, then a success, often means someone guessed a password.
The commands below build a small login log and search it.
Try it: search a login log
mkdir -p incident && cd incident
printf '%s\n' \
"08:58 OK login user=kate" \
"09:02 FAILED login user=olu" \
"09:02 FAILED login user=olu" \
"09:03 FAILED login user=olu" \
"09:03 FAILED login user=olu" \
"09:04 OK login user=olu" \
"09:10 FAILED login user=dina" \
"09:15 OK login user=dina" > auth.log
# Only the failed logins
grep FAILED auth.log
# How many failed logins in total?
grep -c FAILED auth.log
# Which account had the most failures?
grep FAILED auth.log | cut -d= -f2 | sort | uniq -c
# What happened right after the failures for olu?
grep "user=olu" auth.log