Cybersecurity Emergency: Your First Response Guide
When faced with a cybersecurity threat, time is of the essence. These guides provides you with immediate, actionable steps to take when you’re under specific types of attacks. However, each situation can vary, and these steps are not exhaustive nor are they meant to replace professional help. After following these initial steps, we strongly recommend contacting our team immediately. We’re here 24/7 to provide the support and expertise you need to navigate and recover from these potentially damaging situations. Stay safe and act smart with ROI Technology Inc.
If you would like assistance responding to your current cyber attack, email support@roitechnologyinc.com with the details of the attack, and an engineer will be in touch ASAP.
Response Guides
Email Compromise:
This is when an unauthorized person gains access to your email account, potentially controlling personal and business data or even impersonating you for harmful activities.
Step 1: Change Your Password
Immediately change your email password to prevent further unauthorized access. Make sure to create a strong password that combines upper and lower case letters, numbers, and symbols.
Step 2: Check Email Settings
Look for any changes to your email settings that you didn’t authorize, like auto-forwarding emails or added email filters.
Step 3: Scan for Malware
Run a complete antivirus scan on your devices to check for any malware that could be used to capture your email password.
Step 4: Enable Multi-Factor Authentication
Enable multi-factor authentication (MFA) for your email account to add an additional layer of security.
Step 5: Notify Contacts
Inform your contacts about the breach so they can remain vigilant and avoid clicking on suspicious links or attachments.
Step 6: Report the Incident
Report the incident to your email provider. They might have additional steps to secure your account.
Ransomware Attack:
Your system is infected by malicious software that encrypts files, blocking access until a ransom is paid. This can lead to significant data loss and operational disruptions.
Step 1: Disconnect from Network
Immediately disconnect your device from the internet to prevent the ransomware from spreading to other devices.
Step 2: Identify the Ransomware
If possible, identify the type of ransomware you have been infected with. This information can be useful to cybersecurity professionals.
Step 3: Report to Authorities
Report the incident to your local authorities and submit any ransom notes you’ve received.
Step 4: Preserve the Evidence
Try to preserve evidence of the ransomware attack, including ransom messages or suspicious emails, for further investigation.
Step 5: Remove the Ransomware
Contact a cybersecurity professional or use a trusted security tool to try to remove the ransomware from your system.
Step 6: Restore your Files
Restore your files from a backup if possible. If not, consult with professionals to explore your options.
Unusual Network Activity:
This occurs when you detect strange behavior in your network, such as odd traffic, suspicious logs, or unknown device connections, suggesting a potential security breach.
Step 1: Document the Activity
Take note of the unusual activity, capturing screenshots or logs if possible. This will help in investigating the issue.
Step 2: Check Connected Devices
Inspect all the devices connected to your network for any unauthorized access or unusual behavior.
Step 3: Change Network Passwords
Change your network passwords to prevent potential unauthorized access.
Step 4: Update Security Software
Ensure that all your security software, including firewalls and antivirus, are updated to their latest versions.
Step 5: Enable Network Firewall
If not already enabled, activate your network’s firewall to protect your system from potential threats.
Step 6: Consult a Professional
Reach out to a cybersecurity professional who can help identify and mitigate the potential breach.