PHISHING RESPONSE CHECKLIST

DO THIS FIRST

• Call the insurance company that holds your cyber security insurance. They will guide you on their requirements. Their requirements take precedence. Certain steps may need to be taken to protect forensic data. You never want to place yourself between your customer and their ability to collect an insurance claim.
• Check the affected business’s Business Continuity/Disaster/Cyber Recovery Plan for the business. There may be specific requirements mandated by policy or the business owners.
• If possible acknowledge, either in writing or via email, that the infection on occurred prior to your arrival onsite and that you were not the cause of this infection.
• Notify all employees so that they can be vigilant as normally a phishing attack is sent to en entire organization.
• Remember to communicate or reiterate the company’s rules of disclosure to your employees addressing what should or should not be communicated on social media, to the press, and to clients. Typical recommendation is that nothing is permitted to be disclosed un l such time as the company releases a statement (after all the facts of the event have been gathered and analyzed).
• Gather an original copy of the email (DO NOT DELETE IT), it is often needed for forensics as it holds information about the actual sender.

CONTAINMENT

• Run an external penetration test from the internet to look for anything unusual (ports) that shouldn’t be open in the firewall. If you don’t know how to do this or don’t have access to those tools, please send ALL public IP addresses to Creative IT as we may be able to check for you.
• Verify your spam filter is up to date, or install one if one is not present. Block he address or domain that the emails are being sent from.
• Check all security and system logs for any unusual activity. If you are working with Creative IT, let us know if the logs have been deleted from any devices.

● ● ●