Send us the RFP Sign up free
Sign up free Send us the RFP
Back to course

F1 Cyber Basics for Public Service

0% done: 0 of 8 lessons

Lesson 7 of 8 · Video

The first hour of an incident

Progress is saved on this device only. Keep it across devices with a free LFW account.

Curriculum0 of 8 done
2 minutes 25 seconds. Captions are on. Narrated slides: the first-hour checklist from CISA's #StopRansomware Guide, simplified. The narration is a synthesized voice; a recorded voice replaces it later.

What to do, and what not to do, in the first hour after something goes wrong, from a ransom note on the screen to a payment sent to the wrong account.

Notes

Step 1 of 5

Start here

An incident rarely announces itself the way it does in films. It looks like a ransom note on one screen, files with strange new names, a vendor asking where their payment went, or residents saying the town's page is posting nonsense.

What you do in the first hour decides how bad the next month is. This lesson is the short list. It follows CISA's #StopRansomware response checklist, simplified for people who are not IT staff.

Step 2 of 5

What counts as an incident

Treat any of these as an incident and start the steps below:

  • a ransom note, or files you cannot open with unfamiliar endings,
  • a payment, payroll deposit or gift card purchase that went to a criminal,
  • an email account sending messages its owner did not write,
  • a website or social media account posting things nobody at the institution wrote,
  • a lost or stolen laptop or phone with institutional data on it,
  • you entered your password on a page that turned out to be fake.

Step 3 of 5

The first hour, in order

1. Disconnect, do not switch off. Unplug the network cable and turn off Wi-Fi on the affected computer. CISA's checklist says to isolate affected systems first, and to power down only if you cannot disconnect them, because shutting down destroys evidence held in memory.

2. Call, do not email. Phone your IT contact or vendor. If email may be compromised, the attacker could be reading it. CISA advises out-of-band communication, such as phone calls, so you do not tip them off.

3. If money moved, call the bank now. Ask it to recall the funds. Minutes matter more here than anywhere else. Lesson 3 covers this.

4. Leave the evidence alone. Do not delete the ransom note, the suspicious emails or the strange files. Do not run cleanup tools or reinstall anything. Take photos of the screen with your phone.

5. Start a written log. On paper, write the time you noticed, what you saw, what you did, and who you called. Keep adding to it.

6. Tell your supervisor and the head of the institution. If you have an incident response plan, this is when it starts. If you have cyber insurance or belong to a risk pool, check your policy: many require early notice and offer a hotline.

7. Report it. Lesson 8 covers the FBI, CISA and your state.

Step 4 of 5

What not to do

  • Do not pay or contact the attackers. CISA and its partner agencies do not recommend paying a ransom. Paying does not guarantee your data comes back or stays private, and it may carry sanctions risk.
  • Do not post about it on the institution's social media or reply to residents with guesses. Public statements go through whoever your institution designates.
  • Do not wait for certainty. Reporting a false alarm costs a phone call. Waiting a day on a real incident can cost the backups, the money and the records.

Step 5 of 5

You will not be in trouble for reporting

The person who clicked is usually the first to notice. Fast reporting is the best thing anyone can do in an incident, and a good institution says so out loud. If you are a supervisor, thank the person who reported.

Sources

Transcript

Synthesized narration; a recorded voice replaces it later.

  1. 0:00An incident rarely announces itself the way it does in films.
  2. 0:03What you do in the first hour decides how bad the next month is.
  3. 0:07This is the short list, following CISA's StopRansomware response checklist, simplified for people who are not IT staff.
  4. 0:15Treat any of these as an incident: a ransom note, or files you cannot open.
  5. 0:20A payment that went to a criminal.
  6. 0:22An email account sending messages its owner did not write.
  7. 0:25A website posting things nobody wrote.
  8. 0:28A lost laptop or phone.
  9. 0:30Or a password typed into a fake page.
  10. 0:33One.
  11. 0:34Disconnect, do not switch off.
  12. 0:36Unplug the network cable and turn off Wi-Fi on the affected computer.
  13. 0:40Shutting down destroys evidence held in memory, so power down only if you cannot disconnect.
  14. 0:47Two.
  15. 0:47Call, do not email.
  16. 0:49Phone your IT contact or vendor.
  17. 0:52If email may be compromised, the attacker could be reading it.
  18. 0:56Three.
  19. 0:57If money moved, call the bank now, and ask it to recall the funds.
  20. 1:01Minutes matter more here than anywhere else.
  21. 1:05Four.
  22. 1:05Leave the evidence alone.
  23. 1:07Do not delete the ransom note, the suspicious emails or the strange files.
  24. 1:12Do not run cleanup tools.
  25. 1:14Take photos of the screen with your phone.
  26. 1:17Five.
  27. 1:18Start a written log, on paper: the time you noticed, what you saw, what you did, and who you called.
  28. 1:24Keep adding to it.
  29. 1:26Six.
  30. 1:27Tell your supervisor and the head of the institution.
  31. 1:30If you have cyber insurance or belong to a risk pool, check your policy: many require early notice.
  32. 1:37Seven.
  33. 1:38Report it.
  34. 1:39Lesson 8 covers the FBI, CISA and your state.
  35. 1:43What not to do.
  36. 1:44Do not pay or contact the attackers.
  37. 1:47Do not post about it, or reply to residents with guesses.
  38. 1:50And do not wait for certainty.
  39. 1:52Reporting a false alarm costs a phone call.
  40. 1:56You will not be in trouble for reporting.
  41. 1:58The person who clicked is usually the first to notice.
  42. 2:01If you are a supervisor, thank the person who reported.
  43. 2:06Your task.
  44. 2:07Make a one-page first hour card, and print it, because during an incident the computer may not work.
  45. 2:12Put on it your IT contact and a backup person, your bank's fraud line, your supervisor and the head of the institution, your insurer's incident line, and the seven steps in your own words.

Task

Your task at your institution

Make a one-page "first hour" card and print it. It goes on paper because during an incident the computer may not work. Put on it:

Keep a copy at your desk and one with your supervisor. Lesson 8 adds the reporting numbers.

Quiz

5 questions. Choose one answer for each, then check them. Each answer shows its reason.

1. A ransom note appears on your screen. What is the first thing to do with the computer?
2. You suspect your email account was taken over. How do you tell IT?
3. Should you delete the ransom note and the suspicious emails to clean up?
4. What do CISA and its partner agencies say about paying a ransom?
5. Why keep a written log from the first minute?
Show the answers
  1. B. Disconnect it from the network: unplug the cable and turn off Wi-Fi. CISA's checklist says isolate first. Power down only if you cannot disconnect, because shutting down destroys evidence in memory.
  2. B. Call them, or use a different device and account. Attackers may be watching. CISA advises out-of-band communication, such as phone calls, so you do not tip them off.
  3. B. No. Leave them and photograph the screen. Those are evidence. Investigators and your insurer may need them. Photograph what you see and leave it in place.
  4. B. They do not recommend paying. The #StopRansomware Guide says the agencies do not recommend paying: it does not guarantee your data back or that it will not leak.
  5. B. Times, actions and calls are hard to remember later and are needed for reports and insurance. Reports to the FBI, CISA, your bank and your insurer all ask what happened when. Write it down as it happens.