Cyber Incident Response Guide (Personal): Difference between revisions
added link to credit freeze guide on inteltechniques |
added in if no and unsure options to the flow |
||
Line 34: | Line 34: | ||
If you answer '''YES''' to any of these questions, proceed to [[#Secure Your Online Accounts]]. | If you answer '''YES''' to any of these questions, proceed to [[#Secure Your Online Accounts]]. | ||
If you answer '''NO''', continue monitoring your accounts for unusual activity. | |||
If you're '''UNSURE''', consider changing your passwords as a precaution and enabling multi-factor authentication. | |||
===== Device Behavior Issues ===== | ===== Device Behavior Issues ===== | ||
Line 48: | Line 52: | ||
If you answer '''YES''' to any of these questions, proceed to [[#Secure Your Local Devices]]. | If you answer '''YES''' to any of these questions, proceed to [[#Secure Your Local Devices]]. | ||
If you answer '''NO''', keep an eye on your device performance and consider running a periodic malware scan. | |||
If you're '''UNSURE''', run a malware scan and ensure all software is updated. | |||
===== Data Leaks and Breaches ===== | ===== Data Leaks and Breaches ===== | ||
Line 63: | Line 71: | ||
* [https://inteltechniques.com/freeze.html Freeze Your Credit] report to prevent identity theft. | * [https://inteltechniques.com/freeze.html Freeze Your Credit] report to prevent identity theft. | ||
* Proceed to [[#Identify and Lock Down]] and [[#Secure Your Online Accounts]]. | * Proceed to [[#Identify and Lock Down]] and [[#Secure Your Online Accounts]]. | ||
If you answer '''NO''', continue practicing good security hygiene and monitor for any alerts from services you use. | |||
If you're '''UNSURE''', check if any of your accounts have been involved in known breaches using [https://haveibeenpwned.com/ Have I Been Pwned]. | |||
===== Social Engineering and Scams ===== | ===== Social Engineering and Scams ===== | ||
Line 72: | Line 84: | ||
* '''Did you receive an email or message asking for personal or financial information?''' | * '''Did you receive an email or message asking for personal or financial information?''' | ||
* If '''YES''': | * If '''YES''': | ||
* Do not respond or click on any links. | * Do not respond or click on any links. | ||
* Mark the email as spam and delete it. | * Mark the email as spam and delete it. | ||
* Proceed to [[#Secure Your Devices and Network]] if you've interacted with the message. | |||
* ''' | * If '''NO''', remain vigilant against suspicious communications. | ||
* If ''' | * If you're '''UNSURE''', verify the sender's identity through another communication channel before taking action. | ||
'''Financial Scams''' | '''Financial Scams''' | ||
Line 86: | Line 99: | ||
* '''Did someone request money or your banking information?''' | * '''Did someone request money or your banking information?''' | ||
* If '''YES''': | * If '''YES''': | ||
* Be cautious. Scammers often pressure you using fear or urgency. | * Be cautious. Scammers often pressure you using fear or urgency. | ||
* Read about [http://www.consumerfinance.gov/ask-cfpb/what-are-some-common-types-of-scams-en-2092/ common financial scams]. | * Read about [http://www.consumerfinance.gov/ask-cfpb/what-are-some-common-types-of-scams-en-2092/ common financial scams]. | ||
* Proceed to report the incident if necessary. | |||
* ''' | * If '''NO''', stay alert for unusual requests for money or information. | ||
* If | * If you're '''UNSURE''', consult with someone trustworthy before proceeding with any requests. | ||
===== Accidents ===== | ===== Accidents ===== | ||
Line 114: | Line 114: | ||
* '''Has your device been lost or stolen?''' | * '''Has your device been lost or stolen?''' | ||
* If '''YES''': | * If '''YES''': | ||
* Change passwords for your accounts and enable two-factor authentication. | * Change passwords for your accounts and enable two-factor authentication. | ||
* Try to locate the device using a tracking app or service. | * Try to locate the device using a tracking app or service. | ||
* Consider remotely wiping the device to protect your data. | * Consider remotely wiping the device to protect your data. | ||
* If '''NO''', ensure that tracking features are enabled on all devices as a precaution. | |||
* If you're '''UNSURE''', check recent locations if tracking was enabled previously. | |||
* '''Did you accidentally delete important files or information?''' | * '''Did you accidentally delete important files or information?''' | ||
* If '''YES''', proceed to [[#Restore]] for data recovery steps. | * If '''YES''', proceed to [[#Restore]] for data recovery steps. | ||
* If '''NO''', consider setting up regular backups to prevent future data loss issues. | |||
* If you're '''UNSURE''', check if the files are in the recycle bin or use recovery software as needed. | |||
== Secure == | == Secure == | ||
Line 131: | Line 139: | ||
Take these steps immediately: | Take these steps immediately: | ||
# | # Change Passwords: Update passwords for all important accounts. Use a [[Password-manager|Password Manager]] to store them securely. | ||
# Enable Multi-Factor Authentication (MFA): This adds an extra layer of security. See our [[MFA Guide]] for help. | |||
# | # Check for Data Breaches: Visit [https://haveibeenpwned.com/ Have I Been Pwned] to see if your email has been compromised. | ||
# Prioritize Critical Accounts: | |||
# | * Email Accounts: Especially ones used for account recovery. | ||
* Financial Accounts: Banks, credit cards, crypto wallets. | |||
# | * Mobile Carrier Account: To prevent SIM swapping. | ||
* Social Media: To prevent impersonation. | |||
* | # Remove Personal Data from Data Brokers: Use opt-out lists like the [https://github.com/yaelwrites/Big-Ass-Data-Broker-Opt-Out-List Big Ass Data Broker Opt-Out List]. | ||
* | |||
* | |||
* | |||
# | |||
=== Secure Your Local Devices === | === Secure Your Local Devices === | ||
Line 150: | Line 153: | ||
Take these steps to secure your devices: | Take these steps to secure your devices: | ||
# | # Disconnect from the Internet: Unplug your network cable or turn off Wi-Fi to prevent further unauthorized access. | ||
# Run a Malware Scan: Use reputable antivirus software to scan and remove any threats. | |||
# | # Update Your Software: Ensure your operating system and applications are up to date. | ||
# Review Installed Programs: Uninstall any software you don't recognize. | |||
# | # Check Your Browser Extensions: Remove any unfamiliar plugins or toolbars. | ||
# Change Your Device Passwords: Use strong, unique passwords. | |||
# | # Consider Professional Help: If you're unsure, seek assistance from a trusted professional. | ||
# | |||
# | |||
# | |||
=== Secure Your Network === | === Secure Your Network === | ||
Line 168: | Line 165: | ||
Ensure your network is safe: | Ensure your network is safe: | ||
# | # Change Router Passwords: Update the default login credentials. | ||
# Update Router Firmware: Install the latest firmware updates. | |||
# | # Disable Remote Management: Prevent external access to your router settings. | ||
# Set Up a Guest Wi-Fi Network: Isolate your main devices from guests. | |||
# | # Monitor Network Traffic: Use tools to detect unusual activity. | ||
# Refer to the [[Router Hardening]] Guide for detailed steps. | |||
# | |||
# | |||
# | |||
=== Identify and Lock Down === | === Identify and Lock Down === | ||
Line 184: | Line 176: | ||
Protect yourself from identity theft: | Protect yourself from identity theft: | ||
# | # [https://inteltechniques.com/freeze.html Freeze Your Credit]: Contact major credit bureaus. See [https://inteltechniques.com/freeze.html IntelTechniques Credit Freeze Guide]. | ||
# Review Financial Statements: Look for unauthorized transactions. | |||
# | # Update Security Settings: Strengthen privacy and security settings on all accounts. | ||
# Remove Unnecessary Personal Information: From social media and other online platforms. | |||
# | |||
# | |||
== Restore == | == Restore == | ||
Line 196: | Line 185: | ||
Recover from the incident: | Recover from the incident: | ||
# | # Account Recovery: | ||
* Reset passwords and security questions. | |||
* Reset passwords and security questions. | * Use masked emails for sensitive accounts. | ||
* Use masked emails for sensitive accounts. | |||
# Data Recovery: | |||
# | * Restore files from backups if available. | ||
* Use data recovery software or consult a professional. | |||
* Restore files from backups if available. | |||
* Use data recovery software or consult a professional. | |||
* In severe cases, consider reinstalling your OS to ensure all malware is removed. | # Reinstall Operating System: | ||
* In severe cases, consider reinstalling your OS to ensure all malware is removed. | |||
== Report == | == Report == | ||
Line 214: | Line 200: | ||
Reporting helps prevent future incidents: | Reporting helps prevent future incidents: | ||
# | # Contact Financial Institutions: Inform them of any unauthorized activity. | ||
# Report to Law Enforcement: File a report with your local police department. | |||
# | # Notify Affected Parties: Let friends and family know if they might be impacted. | ||
# File Complaints: | |||
# | * With the [https://reportfraud.ftc.gov/#/ FTC] for scams and fraud. | ||
* With other relevant authorities. | |||
# | |||
* With the [https://reportfraud.ftc.gov/#/ FTC] for scams and fraud. | |||
* With other relevant authorities. | |||
== Learn == | == Learn == | ||
Line 229: | Line 211: | ||
Understand and learn from the incident: | Understand and learn from the incident: | ||
# | # Review What Happened: Identify how the incident occurred. | ||
# Educate Yourself: Read about best security practices. | |||
# | # Implement Preventive Measures: Update your habits and tools to enhance security. | ||
# | |||
== Monitor == | == Monitor == | ||
Line 239: | Line 219: | ||
Keep an eye out to prevent future incidents: | Keep an eye out to prevent future incidents: | ||
# | # Regularly Check Accounts: Monitor bank statements and account activities. | ||
# Use Monitoring Services: Consider credit and identity theft monitoring services. | |||
# | # Stay Updated: Follow reputable sources for security news. | ||
# | |||
[[Category:Cybersecurity]] | [[Category:Cybersecurity]] |