What You Should Do
- Think ahead. Establish clear policies in case of an intrusion and create an emergency response team.
- Find your footprint. Create a clear map of your hardware, software and files so you know what your network looks like in a normal state. It will help you see what changed in the event of a hack.
- Contact allies. Touch base with law enforcement before an emergency as well as immediately after a hack.
- Contain the damage. If hit, disconnect the compromised system from the network.
- Rebuild, rearchitect. As you work through recovery, consider a different architecture to prevent future attacks.