A guide to surviving (and learning from) a cyberattack

A recent study by South African cybersecurity firm Nclose revealed a sobering statistic: over 60% of businesses surveyed suffered at least one ransomware attack in the past two years, with 12% enduring six or more such attacks.  

Small and medium enterprises often take the hardest hits. Despite our best efforts to build digital fortresses, cybercriminals—or perhaps bored pensioners in yesterday’s pyjamas—keep trying to breach our defences. Welcome to the not-so-exclusive club of the cyber-compromised. It is like Fight Club but with more frantic Googling of “how to fix a hack” and less bare-knuckle boxing. 

If you’ve just discovered you’re the newest member of this club, don’t start drafting your resignation letter in the style of a Shakespearean tragedy just yet. Instead, let’s roll up our sleeves and get to work.  

Here’s your survival guide for when the digital hit the fan. 

Step 1: Raising the alarm – Or ‘how to stop the bleeding with duct tape’ 

First things first, contain the breach. If someone opened a window on a submarine, you would not start by investigating who did it or why. You would be too busy trying not to drown. Similarly, your priority is to find that digital ‘open window’ and seal it shut faster than you can say “data breach”. 

Can you isolate the affected systems quickly? It might mean kicking one infected laptop off the network, or it could require shutting down all your servers. Yes, this might lead to some downtime and grumpy colleagues, but that is better than having your entire customer base and intellectual property dumped on some dark web forum.  

Step 2: Digital forensics – Or ‘how to play cyber detective’ 

Now that you’ve stopped the immediate bleeding, it’s time to investigate. Collect every digital breadcrumb: logs, access records, and that suspicious email your finance manager clicked on because it promised free money.  

But here’s the rub – good forensics firms are like gold dust in a crisis. If you wait until after you have been breached to look for one, you might find yourself at the back of a lengthy queue. So, do yourself a favour and get someone on retainer now. 

It also pays dividends to actively check that you’re logging everything you need to log and securely backing up the logs.  

Step 3: The blame game (Spoiler: There’s enough to go around) 

It’s tempting to point fingers. Maybe it was Dave from accounting who still uses “password123” for everything, or perhaps the pesky remote workers clicking on “You’ve won a new car!” emails. But playing the blame game is about as productive as trying to herd cats—entertaining, but ultimately futile. 

Remember, a successful breach is like a perfect storm. It bypasses multiple layers of technology and processes, and manages to social engineer an unsuspecting colleague. Use this as a learning opportunity, not a witch hunt. Don’t punish or shame an individual for simply trying to do their job.  

Step 4: Fortify the gates – Building your moat and other medieval strategies 

Once you’ve licked your wounds, it’s time to rebuild. Channel your inner Six Million Dollar Man and make your systems stronger, smarter, and faster. Upgrade your software, enforce multi-factor authentication (MFA), and build a robust human risk management strategy. These will be the foundations of a security culture so strong it could repel a digital army. 

Step 5: Looking forward – Embrace your inner cyber-pessimist 

The final step is acceptance. Accept that this might happen again because, well, it probably will. Wear your cynicism like armour and question everything, from suspicious emails to why there’s leftover pizza in the boardroom. 

Cultivating a healthy level of paranoia isn’t just for conspiracy theorists anymore – it’s a cybersecurity best practice. It’ll keep everyone on their toes and your systems safer than Fort Knox. 

Groundhog Day: Bouncing the unwelcome reality check 

If you’ve made it this far, congratulations—you’ve survived your first cyberattack. Now, armed with a stronger security culture, updated tech, robust processes, and a slightly bruised ego, you’re ready to face the next challenge. 

That next challenge? Most likely answering a barrage of questions about what you’d do differently next time. And trust me, there will be a next time – probably sooner than you think. But this time, you’ll be ready. You’ll be the cyber-survivor with a tale to tell and the battle scars to prove it. 

Keep in mind, in the world of cybersecurity, it is not about if you will face an attack, but rather when it will happen. So, keep your wits about you, your team educated, and your systems patched and updated. 

By: Javvad Malik

×