Session 7: Incident Response & Recovery

Most controls reduce the likelihood of something going wrong. Backups reduce the impact of the worst outcome, which is why they come first in every prioritisation in this course. Ransomware, a failed drive, a stolen laptop, an accidental deletion, a corrupted update — every one of those stops being a catastrophe and becomes an inconvenience if a working backup exists, and stays a catastrophe if it does not.

The standard scheme is 3-2-1: three copies of your data, on two different kinds of media, with one copy off-site. In practice for a small business that means the working files on the machine, a second copy on an external drive or a network location, and a third in cloud storage. The off-site copy is the part people skip, and it is the part that matters when the premises burn, flood or are burgled — which happens.

Then the part that defeats naive backups: ransomware encrypts whatever it can reach, including a mapped network drive and a permanently connected external disk. So the off-site or offline copy must be genuinely separated — a drive that is disconnected when not backing up, or cloud storage with versioning, which keeps previous versions so an encrypted or deleted file can be rolled back. A backup that is connected at the moment of infection is just another copy for the ransomware to encrypt.

An untested backup is a hope, not a control. Drives fail silently, sync jobs stop running after an error nobody read, and the folder that was being backed up is not the folder that mattered. The only way to know is to restore something and open it.

Test on a schedule — monthly for a small business is reasonable — and test properly: pick a real file, restore it to a different location, and open it to confirm it is intact and current. Once a quarter, do a larger test: restore a whole folder, or better, boot from the recovery media to confirm the machine itself can be rebuilt. Record the date and result each time, because a log of successful restores is genuinely useful evidence and it catches the month the job quietly stopped.

Also test what you would do without the machine. If the laptop is stolen on a Monday, how does the business operate on Tuesday? Knowing the answer in advance — which files are essential, where the credentials live, who to call — is worth more than any single backup, because it turns a crisis into a procedure.

When something has gone wrong, order matters more than speed, and the sequence is fixed. Detect and confirm — establish what is actually happening rather than assuming. A slow machine is not necessarily compromised; a bank alert you did not expect probably is. Contain — stop the damage spreading: disconnect the affected machine from the network, disable the compromised account, change the credentials from a clean device, revoke active sessions.

Then assess — what was affected, what data was involved, what is the exposure. Then eradicate — remove the cause: the malware, the attacker's access, the vulnerability they used. Then recover — restore systems and data in the right order, which section five covers. Then review, which most people skip and which is the only part that prevents the next one.

Two rules govern the whole sequence. Do not power off a machine you suspect is actively compromised if you may need evidence — a shutdown can destroy volatile data, and for a business facing a fraud claim or a police report, that evidence matters. Suspend or disconnect it from the network instead. And do not rush to rebuild, because rebuilding before you understand the entry point means rebuilding the same vulnerability, and you will be back here in a month.

Containment is about stopping the spread while preserving what you may need. Disconnect from the network — pull the cable or disable Wi-Fi — which stops lateral movement and stops data leaving, without destroying anything on the disk. Do not shut down unless you must; volatile memory holds running processes and network connections that are gone forever at power-off.

Change credentials from a clean device, not from the compromised one, because a keylogger there will simply capture the new password. Revoke active sessions across email and social accounts, because an attacker holding a session token keeps access after a password change. Disable the account if a staff member's credentials are involved, rather than only changing the password.

Then preserve what you have: photograph any error message or ransom note, note the times of what happened, and if the incident involves money or a customer's data, keep the machine aside rather than wiping it. In Nigeria, financial fraud should be reported to the platform and to the police, and the EFCC handles financial crime; a preserved machine and a documented timeline are what make a report useful rather than anecdotal.

Recovery has an order, and getting it wrong wastes days. Restore the essentials first — whatever the business needs to trade: the customer list, the order records, the communication channels. Not everything at once. Verify each restore by opening the files before you rely on them, because a restore that silently failed is worse than none, since you believe you are safe. Rebuild rather than clean where the machine was compromised: recover the data, verify it, then install fresh, because a cleaned machine is probably fine and a rebuilt one is known to be fine.

Then change every credential that was on the affected machine, revoke sessions, and only reconnect it once it is clean and updated. Confirm the vulnerability is closed — the pirated software removed, the router password changed, the two-factor enabled — before considering the incident over. Recovering without closing the entry point is how the same incident happens again.

Finally, review. Write down what happened, how it got in, what worked, what did not, and what you will change. Then make those changes: the backup that was missing, the two-factor that was never enabled, the staff member who needs ten minutes of explanation. Most incidents are not sophisticated; they are an unpatched system, a reused password or a clicked link. The review is where a bad week becomes a permanently better setup, and skipping it is the most expensive omission in this entire course.