Cyber incident response: stop the attack, keep the evidence, get back to work.

The Canadian Centre for Cyber Security defines a cyber incident as any unauthorized attempt, successful or not, to get into, change, delete, block access to or shut down a system, network or account. That covers more than ransomware.

The calls we get most often start with a ransom note on a screen, a supplier saying your invoice now has new bank details, a mailbox sending messages nobody wrote, or a security alert that comes back after it was cleared. If any of those is happening, treat it as an incident until someone has checked.

The first call is triage. We want to know what you saw and when, what systems you run (Microsoft 365 or Google Workspace, on-premise servers, who manages them), what has already been changed, whether backups exist and when they last ran, and if you have cyber insurance or a lawyer involved.

By the end of the call you should have a short list of what to do, what to leave alone and who else needs to be told. The incident response FAQ has the longer answers to the questions people ask in those first hours.

We follow the shape set out in NIST SP 800-61 Rev. 3, which treats response as part of ongoing risk management rather than a single clean-up. For ransomware we also work from the Cyber Centre's ransomware playbook (ITSM.00.099).

1. 01

   Contain

   Cut the attacker's access in a planned order: sessions, sign-in methods, mailbox rules, app consents and remote access tools, not just passwords.

2. 02

   Preserve

   Image key machines and export logs before they roll over. Microsoft 365 and Google Workspace logs have limited retention, so this happens early.

3. 03

   Investigate

   Work out the entry point, what the attacker did and what they could see or take, and record what cannot be determined.

4. 04

   Recover

   Restore from backups that have been checked, once the entry point is closed, so you are not restoring the same weakness.

5. 05

   Report

   Write up the timeline, findings and fixes in a form your counsel, insurer and board can use.

A pharmaceutical services client had a mailbox taken over. Working from primary evidence, we rebuilt the attack minute by minute, including 2,706 emails sent from the account in under forty minutes. Years later the same client asked us to design centralized identity and device management across four countries. The full case study sets out what we found.

When breach counsel is retained, we work under counsel's direction. Whether that protects the analysis under privilege depends on the facts, so that is your lawyer's call. For counsel, insurers and brokers explains how we work with each.

Under PIPEDA, a breach of security safeguards that creates a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada and to affected individuals as soon as feasible. Quebec, Alberta and Ontario's health sector have their own rules; the privacy breach FAQ covers them.

• A timeline of the incident from first sign of access to containment
• The entry point and the evidence for it
• What the attacker accessed or took, and what could not be established
• The containment and recovery steps taken, with dates
• Recommended fixes, ranked by how much they reduce the chance of a repeat

Each of these has its own page with the steps that differ: ransomware response, business email compromise, Microsoft 365 and Exchange forensics and the first 72 hours of an incident. Our full service description is on incident response.

The 24/7 incident line is (289) 582-9930.