What do you do if your network security is compromised?

- immediately disconnected the affected devices from the network and should be determine the extent of the breach to know the info may have been compromised. - change all PWs for all affected ACC and systems also change the Admin ACC. - update software & firmware to the latest preferred versions and identify any vulnerabilities that may have been exploited by the attacker. - investigation to understand how the breach occurred and take the necessary action to prevent similar incidents again. - enhance the security levels, make sure and reviewing the ACL, using MFA, EDR, NDR, MAil gateway, SIEM to reduce the risks. - finally need to provide training and educate the employees to understand the extent of the risks that we can fall into.

If your network security is compromised, take immediate action to isolate affected systems, assess the damage, contain the threat, investigate the root cause, restore from backups, implement security updates, educate employees, report the incident if necessary, and continuously monitor and review for further threats.

After identifying the scope of compromise the immediate first action would be to quarantine and disconnect from any network the compromised system then since you have the time and tools to fully check the system.

First, the response plan must be activated in the event of an incident being identified and a possible security compromise, then it must be assessed whether the incident represents a risk or whether there has already been relevant damage caused to holders of personal data, and if so, follow with incident reporting in accordance with local data protection legislation. In parallel, the response team follows the containment, eradication and recovery steps provided for in the previously created and trained plan. Self-analysis is very important for the process of lessons learned from the incident and its subsequent documentation.

Determine the Extent and Source of Your Data breach Immediately after you become aware of a data incident, then determine the extent of the loss of information and extent of the breach and denie acces to the bad actors.

When dealing with a compromised network, follow these steps(very high level, more detailed are required): 1. Alert IT: Notify your IT security team promptly. 2. Change Passwords: Secure affected accounts. 3. Mitigate Vulnerabilities: Address the breach. 4. Notify Authorities: Inform relevant parties. 5. Strengthen Security: Prevent future incidents.

I would always look to notify everyone involved. Again, this is where an Asset Inventory with the correct Point of Contact is stored, and I can reach all the teams with Automation, whether it would be with Slack/Teams/Email/etc... From there, we can leverage that Asset Inventory to figure out where it's connected and look up the business use. If it's customer-facing (either internal or external), then make a business decision.

Isolate compromised host from the network and investigate the issue with the help of SOC .Fetch logs from SIEM and EDR solutions identify the suspicious attempts and take further appropriate actions

Containing the breach and isolating affected systems is critical to prevent further damage. However, I'd advise against a "slash and burn" approach. While swift action is necessary, it's important to balance containment with preserving evidence for forensic analysis. Before disconnecting or quarantining systems, consider creating forensic images or collecting logs and other relevant data. This information can be invaluable for understanding the attack and identifying the attackers. Additionally, remember that containment measures can disrupt business operations. Coordinate with your IT and business teams to ensure critical systems remain functional and minimize downtime..

From my perspective if the network security is compromised the best things to do would be: 1 - check with the security team and inform them about the situation. 2 - check the latest vulnerabilities for your security devices and their OS running to see if they are important and required to be applied. 3 - proceed to change any password used to login to the system taking into account to use secure hashes while changing them instead of using the plain text. 4 - check login database and proceed to quickly deactivate any unauthorized user.

Immediately isolate compromised systems to contain the breach, conduct a thorough forensic analysis to identify the attack vector and extent of infiltration, and implement remediation measures such as patching vulnerabilities and updating security protocols. Additionally, enhance monitoring capabilities and educate personnel on cybersecurity best practices to prevent future incidents.

Once the compromised systems are isolated, proceed to eradicate the compromise by removing any malware or unauthorized software. This may involve running antivirus scans, applying security patches, and restoring affected systems from clean backups.

Eradicating the attacker's presence and eliminating malware is crucial for restoring network security. However, I'd caution against simply relying on automated tools. In my experience, manual inspection and analysis are often necessary to ensure complete removal of malicious code and backdoors. This might involve reviewing system logs, analyzing network traffic, and manually removing suspicious files or registry entries. Additionally, consider the potential for reinfection. If the attacker exploited a vulnerability, ensure it's patched not only on the affected systems but across your entire network. Review your security posture and implement additional controls to prevent similar attacks in the future.

Avant de supprimer ou d'éradiquer les virus, scripts ou malwares, il est important de faire un clone de vos disques touchés ainsi que de la RAM dans laquelle nous pouvons aussi avoir des indices (ioc). Ces copies (dump ou DD ou clonage) devront être signés numériquement et devront être gardés intacts pour les autorités si une plainte est déposée.

This is the part where you go all detective mode and clean house. Get rid of any viruses or malware, patch up any security holes they used to get in, and double-check to make sure you’ve kicked them out for good.

Recovering systems and data after a breach is essential for restoring business operations. However, I'd emphasize the importance of verifying the integrity of your backups before restoration. Attackers often target backups to hinder recovery efforts. Ensure your backups are stored securely and regularly test their integrity to ensure they haven't been tampered with. Additionally, consider the potential for data loss. If the attacker encrypted or destroyed data, recovery might not be possible. Be prepared to accept some data loss and have contingency plans in place to minimize business disruption.

After eradicating the compromise, focus on recovering the affected systems and data. Restore systems from backups to ensure they are clean and free from any remnants of the security breach. Verify the integrity of restored data to ensure it has not been tampered with.

In my experience this is where your disaster recovery plan - if properly planned, built and deployed - will deliver dividends to restore services.

You have to do reset the systems to default and update recovery and if possible reconfiguration the administrative and user logins. Finally you have to update the system firmware and operating systems to the latest versions.

Always check that all your back is working before any thing happen or all of them are useless. Hopefully, you’ve been backing up your stuff regularly. Now’s the time to use those backups to get your systems back to normal. It’s like hitting the undo button on the mess

Reviewing the incident and improving security is crucial for preventing future breaches. However, I'd emphasize the importance of going beyond technical solutions. In my experience, fostering a culture of security awareness is equally important. Train your employees to recognize phishing attempts, practice good password hygiene, and report suspicious activity. Additionally, consider conducting regular security audits and penetration tests to proactively identify and address vulnerabilities in your network. Remember, security is an ongoing process, not a one-time fix. Continuously monitor threat intelligence, update your security policies, and adapt your defenses to the evolving threat landscape.

Conduct a post-incident review to analyze the root causes of the security breach and identify areas for improvement. This may involve updating security policies and procedures, implementing additional security controls, and providing staff training to prevent similar incidents in the future

Following a network security breach, immediate actions include confirming the breach, isolating compromised systems, and preserving evidence for analysis. It's vital to assess the damage, patch vulnerabilities, and securely restore systems. Transparent communication with stakeholders and a thorough post-incident review are essential for understanding the breach's scope and improving security measures. This process also involves updating security protocols, enhancing staff training, and adhering to legal reporting obligations. External cybersecurity expertise and law enforcement may be engaged for significant breaches to aid in recovery and bolster defenses against future threats.

In my experience the key to a good post-mortem incident analysis must include the individuals who were involved in the incident response, including security analysts, IT administrators, management, and any third-party experts or consultants.

After all the chaos, take a step back and learn from what happened. How did they get in? What could you do better? Make some changes so that next time, your network is as tough as a fortress.

Training and retraining of users to understand the different types of social engineering and how to mitigate against such attacks. Most internal network comprises happen because many users don't identify on time a social engineering attack. As information technology is evolving through AI new types of social engineering attack may likely evolve thus, the need to keep users up to date with identification of the type of attack and how to mitigate against them.

One thing and not less important is staying calm to make the best decision when your network is under attack you must detect what kind of attack is performing and what countermeasures are the best for each case. It's not the same to receive a malware attack, DDoS attack or fishing attack the response is not the same. The way to re-establish the service is different for each case.

And don’t forget to keep everyone in the loop about what happened and what you’re doing about it. Transparency is key to making a secure network and job!!

7. Investigate the incident. Conduct thorough investigation to understand the breach, data and the systems affected 8. Notify the affected parties, employess,customers and stakeholders if thier personal sensitive information was compromise. 9. Restore normal operations since the threat has been remove and affected systems are secure. 10. Learn from the experience and knowledge gained from the incident and improve your security and protect your network from future attacks

User training, communication and honest assessment are all key factors here. Everyone from front end admins to end users are all key resources here to protecting the network.