You Clicked on Something You Shouldn’t Have, Now What?

“First 24 Hours” Checklist

Here is a helpful checklist provided by Pink Hat Technology on what to do when you accidentally clicked on a risky link or graphic.

1. Disconnect the computer from the network and share what happened with a skilled IT person.

a. If you have a desktop, reach around the back of your computer and unplug the Ethernet cable.

If you are using a mobile device on Wi-Fi, go in and turn off the wi-fi access.

This is so that the infection cannot crawl to other computers.

b. Take a picture of the screen (s) on your computer that indicate you might be infected, or what you clicked on, and text those to your IT person. They should be able to identify the threat impact and tell you if you can plug your computer back in, or what to do next.

i. Managed Service Provider emergency contact phone:

i.i. Managed Service Provider emergency contact email:

i.i.i. Forensics Team emergency contact phone:

c. Note that we didn’t say to shut down your computer. We’ve been told by the LA District Attorney’s office that this can eliminate forensic evidence that might be important later.

2. Agree on the incident response plan you will follow and communicate it to the executive team. The information shared internally with all staff, if everyone is affected, should be limited to a “data disruption” or something vague, until official wording can be approved by the executives.

3. Preserve the evidence (i.e. don’t wipe hard drives, etc) and follow any compliance mandates about physically securing the breach and affected equipment.

4. Begin remediation of the breach being careful to ensure unaffected systems are 100% clean.

5. Update the executives on the recovery /cleanup process so that communication to staff and shareholders can take place

6. Notify law enforcement – Locally that would be the LA District Attorney’s Office. Federally it would be the FBI and the Secret Service, if applicable (see attached). Be careful not to include actual data that was compromised in your reporting, as the HIPAA Privacy Rules do not permit this.

a. LA District Attorney’s Office Cyber Crime Task Force Phone: 213-257-2428

b. FBI- see attached guidelines called “Law Enforcement Cyber Incident Reporting.pdf”

7. Check with the cyber liability insurance carrier and/or legal council on notification procedures if necessary.

a. Insurance Carrier Breach Reporting Number:

b. Legal Council name & number:

8. Document everything you can about the breach:

a. How it happened

b. Who is impacted

c. What the initial notification steps were

d. What the incident response plan is

e. Who has been notified

Hundreds of Business Opportunities – Visit the Home Business EXPO