Post-Attack Tasks Are Just as Important as Mitigating an Active Attack, Experts Say

A large number of organizations fall victim to cybercriminals these days and many of those that haven’t been impacted by a data breach are well aware that it’s only a matter of time before they become targeted by hackers.

However, experts highlight the fact that when responding to a cyberattack, organizations should think long and hard about the steps that need to be taken after the active attack has been mitigated.

According to Rob Kraus, director of research at Solutionary’s Security Engineering Research Team (SERT), preparing for and mitigating attacks when they materialize is just the start.

“Many organizations fail to realize that after the attacks are over, a lot more work is still required,” Kraus explained in a blog post.

The list of tasks that must be performed after the attack is over is long and in some cases, they can cost even more than the incident itself, but post-mitigation is a vital part of the process.

Some of the post-attack tasks highlighted by the expert include notifying the board of directors of the impact of the attack, notifying clients, identifying the backdoors that the attackers might try to utilize on future occasions, and creating and maintaining forensic images.

There are several aspects that must be taken into consideration when verifying what the attackers might have modified or planted on your organization’s network. This includes identifying modifications made to system or application files, modifications made to legitimate user accounts, suspicious services, and malicious communications channels.

“You were vulnerable once before and the attacker knows this. Do you think they will try again? I do. Worse yet, if other attackers know you have been compromised, do you think that might encourage them to attack as well? That answer is, unfortunately, also ‘yes’,” Kraus noted.

“It is vital to ensure that you perform proper post-incident analysis. It will help your organization prepare for future attacks and significantly increase your organization’s knowledge of what you’re up against.”