After a breach: what to preserve

Why preserve before you repair?

Every incident leaves traces: in log files, in a computer’s memory, on its disk and in the accounts the attacker used. Many repair steps wipe those traces. Once they are gone, it becomes very hard to say how the attacker got in, what they touched and whether they are still there.

Preserving first does not mean doing nothing. It means making each containment step deliberately, with someone keeping track of what was done.

It also protects you. Insurers, regulators, auditors and courts may later ask what happened and how you responded, and a preserved record answers those questions better than anyone’s recollection.

What should you do straight away?

1. 01

   Do not wipe or reimage

   Leave affected machines as they are. Reinstalling the system, restoring from backup over the top or running clean-up tools erases the record of the attack.

2. 02

   Leave running machines on

   Memory holds running programs, open network connections and sometimes keys that vanish at shutdown. Where possible, have it captured by a trained examiner before anything is powered off.

3. 03

   Isolate carefully, on IT advice

   Disconnecting a machine from the network can stop the spread, but the method matters. Agree with your IT team how to cut it off without switching it off or alerting the intruder unnecessarily.

4. 04

   Write down what you saw

   Note the time, the screen messages, unusual pop-ups, ransom notes and who noticed what. Photograph screens with a separate phone rather than saving files on the affected machine.

Assume the attacker may be reading company email. Discuss the incident by phone or through a separate account until you know the mail system is safe.

Which logs and records should you keep?

Logs are often the only record of how an intruder moved. Some systems keep them only for a limited period and then overwrite them, so ask for copies to be exported early.

• Firewall, VPN and remote-access logs.
• Email sign-in records, forwarding rules and mailbox audit logs.
• Server, domain controller and endpoint security alerts.
• Cloud service audit logs and administrator activity.
• Backups taken before the incident, kept untouched and separate from the network.

Hold off on a full antivirus scan that deletes or quarantines files until someone has copied what is there. The suspicious files are themselves part of the evidence. When passwords are reset, do it from a device you know is clean, and list each account changed so the timeline shows when the intruder lost access.

Start a single timeline as soon as you can. Each entry records the date and time, what happened, who did it and what was changed. This one document will help everyone who joins later, from examiners to insurers.

Who should you involve?

• Your IT lead, and any outside provider who runs your systems, briefed to preserve before they fix.
• Senior management, kept to a small group who need to make decisions.
• Your advocate, early, about reporting duties, contracts and any legal action.
• Your insurer, if you hold cyber cover, since policies often set notification conditions.
• Your bank, without delay, if the incident touched payment instructions, supplier bank details or online banking access.
• Incident response and forensic specialists, to capture memory and disks properly and work out what happened.

If personal data may have been exposed, Kenya’s Data Protection Act 2019 can require you to notify the regulator and, in some cases, the people affected. Ask counsel about the timing as soon as the possibility arises.

How can we help?

We provide incident response, along with memory and disk examination to establish how an attack unfolded. Once the incident is closed, a cyber security assessment can show where the defences need strengthening.

Memory capture is time-sensitive, so it helps to make contact before machines are restarted. Bring your timeline and a list of the systems affected to the first conversation.

If you may later take action against the intruder, or defend a claim, careful preservation keeps that option open. Whether evidence is admitted is decided by the court in each case.

Terms in this guide

• Incident response
• Volatile memory

Questions