Cyber Incident Response Guide (Personal): Difference between revisions

added link to credit freeze guide on inteltechniques
added in if no and unsure options to the flow
Line 34: Line 34:


If you answer '''YES''' to any of these questions, proceed to [[#Secure Your Online Accounts]].
If you answer '''YES''' to any of these questions, proceed to [[#Secure Your Online Accounts]].
If you answer '''NO''', continue monitoring your accounts for unusual activity.
If you're '''UNSURE''', consider changing your passwords as a precaution and enabling multi-factor authentication.


===== Device Behavior Issues =====
===== Device Behavior Issues =====
Line 48: Line 52:


If you answer '''YES''' to any of these questions, proceed to [[#Secure Your Local Devices]].
If you answer '''YES''' to any of these questions, proceed to [[#Secure Your Local Devices]].
If you answer '''NO''', keep an eye on your device performance and consider running a periodic malware scan.
If you're '''UNSURE''', run a malware scan and ensure all software is updated.


===== Data Leaks and Breaches =====
===== Data Leaks and Breaches =====
Line 63: Line 71:
* [https://inteltechniques.com/freeze.html Freeze Your Credit] report to prevent identity theft.
* [https://inteltechniques.com/freeze.html Freeze Your Credit] report to prevent identity theft.
* Proceed to [[#Identify and Lock Down]] and [[#Secure Your Online Accounts]].
* Proceed to [[#Identify and Lock Down]] and [[#Secure Your Online Accounts]].
If you answer '''NO''', continue practicing good security hygiene and monitor for any alerts from services you use.
If you're '''UNSURE''', check if any of your accounts have been involved in known breaches using [https://haveibeenpwned.com/ Have I Been Pwned].


===== Social Engineering and Scams =====
===== Social Engineering and Scams =====
Line 72: Line 84:
* '''Did you receive an email or message asking for personal or financial information?'''
* '''Did you receive an email or message asking for personal or financial information?'''


* If '''YES''':
  * If '''YES''':
* Do not respond or click on any links.
    * Do not respond or click on any links.
* Mark the email as spam and delete it.
    * Mark the email as spam and delete it.
    * Proceed to [[#Secure Your Devices and Network]] if you've interacted with the message.


* '''Did you click on a suspicious link or download an attachment from an unknown source?'''
  * If '''NO''', remain vigilant against suspicious communications.


* If '''YES''', proceed to [[#Secure Your Devices and Network]].
  * If you're '''UNSURE''', verify the sender's identity through another communication channel before taking action.


'''Financial Scams'''
'''Financial Scams'''
Line 86: Line 99:
* '''Did someone request money or your banking information?'''
* '''Did someone request money or your banking information?'''


* If '''YES''':
  * If '''YES''':
* Be cautious. Scammers often pressure you using fear or urgency.
    * Be cautious. Scammers often pressure you using fear or urgency.
* Read about [http://www.consumerfinance.gov/ask-cfpb/what-are-some-common-types-of-scams-en-2092/ common financial scams].
    * Read about [http://www.consumerfinance.gov/ask-cfpb/what-are-some-common-types-of-scams-en-2092/ common financial scams].
    * Proceed to report the incident if necessary.


* '''Did you send money to someone you suspect is a scammer?'''
  * If '''NO''', stay alert for unusual requests for money or information.


* If '''YES''':
  * If you're '''UNSURE''', consult with someone trustworthy before proceeding with any requests.
* Stop all communication with the scammer.
* Report the incident to your local police department.
* File a complaint with the [https://reportfraud.ftc.gov/#/ FTC].
 
* '''Did you install anything provided by the scammer?'''
 
* If '''YES''', proceed to [[#Secure Your Devices and Network]].
 
* '''Did you give out personal or sensitive information?'''
 
* If '''YES''':
* Report the incident to your local police department.
* File a complaint with the [https://reportfraud.ftc.gov/#/ FTC].
* Proceed to [[#Identify and Lock Down]].


===== Accidents =====
===== Accidents =====
Line 114: Line 114:
* '''Has your device been lost or stolen?'''
* '''Has your device been lost or stolen?'''


* If '''YES''':
  * If '''YES''':
* Change passwords for your accounts and enable two-factor authentication.
    * Change passwords for your accounts and enable two-factor authentication.
* Try to locate the device using a tracking app or service.
    * Try to locate the device using a tracking app or service.
* Consider remotely wiping the device to protect your data.
    * Consider remotely wiping the device to protect your data.
 
  * If '''NO''', ensure that tracking features are enabled on all devices as a precaution.
 
  * If you're '''UNSURE''', check recent locations if tracking was enabled previously.


* '''Did you accidentally delete important files or information?'''
* '''Did you accidentally delete important files or information?'''


* If '''YES''', proceed to [[#Restore]] for data recovery steps.
  * If '''YES''', proceed to [[#Restore]] for data recovery steps.
 
  * If '''NO''', consider setting up regular backups to prevent future data loss issues.
 
  * If you're '''UNSURE''', check if the files are in the recycle bin or use recovery software as needed.


== Secure ==
== Secure ==
Line 131: Line 139:
Take these steps immediately:
Take these steps immediately:


# '''Change Passwords''': Update passwords for all important accounts. Use a [[Password-manager|Password Manager]] to store them securely.
# Change Passwords: Update passwords for all important accounts. Use a [[Password-manager|Password Manager]] to store them securely.
 
# Enable Multi-Factor Authentication (MFA): This adds an extra layer of security. See our [[MFA Guide]] for help.
# '''Enable Multi-Factor Authentication (MFA)''': This adds an extra layer of security. See our [[MFA Guide]] for help.
# Check for Data Breaches: Visit [https://haveibeenpwned.com/ Have I Been Pwned] to see if your email has been compromised.
 
# Prioritize Critical Accounts:
# '''Check for Data Breaches''': Visit [https://haveibeenpwned.com/ Have I Been Pwned] to see if your email has been compromised.
  * Email Accounts: Especially ones used for account recovery.
 
  * Financial Accounts: Banks, credit cards, crypto wallets.
# '''Prioritize Critical Accounts''':
  * Mobile Carrier Account: To prevent SIM swapping.
 
  * Social Media: To prevent impersonation.
* '''Email Accounts''': Especially ones used for account recovery.
# Remove Personal Data from Data Brokers: Use opt-out lists like the [https://github.com/yaelwrites/Big-Ass-Data-Broker-Opt-Out-List Big Ass Data Broker Opt-Out List].
* '''Financial Accounts''': Banks, credit cards, crypto wallets.
* '''Mobile Carrier Account''': To prevent SIM swapping.
* '''Social Media''': To prevent impersonation.
 
# '''Remove Personal Data from Data Brokers''': Use opt-out lists like the [https://github.com/yaelwrites/Big-Ass-Data-Broker-Opt-Out-List Big Ass Data Broker Opt-Out List].


=== Secure Your Local Devices ===
=== Secure Your Local Devices ===
Line 150: Line 153:
Take these steps to secure your devices:
Take these steps to secure your devices:


# '''Disconnect from the Internet''': Unplug your network cable or turn off Wi-Fi to prevent further unauthorized access.
# Disconnect from the Internet: Unplug your network cable or turn off Wi-Fi to prevent further unauthorized access.
 
# Run a Malware Scan: Use reputable antivirus software to scan and remove any threats.
# '''Run a Malware Scan''': Use reputable antivirus software to scan and remove any threats.
# Update Your Software: Ensure your operating system and applications are up to date.
 
# Review Installed Programs: Uninstall any software you don't recognize.
# '''Update Your Software''': Ensure your operating system and applications are up to date.
# Check Your Browser Extensions: Remove any unfamiliar plugins or toolbars.
 
# Change Your Device Passwords: Use strong, unique passwords.
# '''Review Installed Programs''': Uninstall any software you don't recognize.
# Consider Professional Help: If you're unsure, seek assistance from a trusted professional.
 
# '''Check Your Browser Extensions''': Remove any unfamiliar plugins or toolbars.
 
# '''Change Your Device Passwords''': Use strong, unique passwords.
 
# '''Consider Professional Help''': If you're unsure, seek assistance from a trusted professional.


=== Secure Your Network ===
=== Secure Your Network ===
Line 168: Line 165:
Ensure your network is safe:
Ensure your network is safe:


# '''Change Router Passwords''': Update the default login credentials.
# Change Router Passwords: Update the default login credentials.
 
# Update Router Firmware: Install the latest firmware updates.
# '''Update Router Firmware''': Install the latest firmware updates.
# Disable Remote Management: Prevent external access to your router settings.
 
# Set Up a Guest Wi-Fi Network: Isolate your main devices from guests.
# '''Disable Remote Management''': Prevent external access to your router settings.
# Monitor Network Traffic: Use tools to detect unusual activity.
 
# Refer to the [[Router Hardening]] Guide for detailed steps.
# '''Set Up a Guest Wi-Fi Network''': Isolate your main devices from guests.
 
# '''Monitor Network Traffic''': Use tools to detect unusual activity.
 
# '''Refer to the [[Router Hardening]] Guide''' for detailed steps.


=== Identify and Lock Down ===
=== Identify and Lock Down ===
Line 184: Line 176:
Protect yourself from identity theft:
Protect yourself from identity theft:


# '''[https://inteltechniques.com/freeze.html Freeze Your Credit]''': Contact major credit bureaus to [https://inteltechniques.com/freeze.html Freeze Your Credit]. See [https://inteltechniques.com/freeze.html IntelTechniques Credit Freeze Guide].
# [https://inteltechniques.com/freeze.html Freeze Your Credit]: Contact major credit bureaus. See [https://inteltechniques.com/freeze.html IntelTechniques Credit Freeze Guide].
 
# Review Financial Statements: Look for unauthorized transactions.
# '''Review Financial Statements''': Look for unauthorized transactions.
# Update Security Settings: Strengthen privacy and security settings on all accounts.
 
# Remove Unnecessary Personal Information: From social media and other online platforms.
# '''Update Security Settings''': Strengthen privacy and security settings on all accounts.
 
# '''Remove Unnecessary Personal Information''': From social media and other online platforms.


== Restore ==
== Restore ==
Line 196: Line 185:
Recover from the incident:
Recover from the incident:


# '''Account Recovery''':
# Account Recovery:
 
  * Reset passwords and security questions.
* Reset passwords and security questions.
  * Use masked emails for sensitive accounts.
* Use masked emails for sensitive accounts.
 
 
# Data Recovery:
# '''Data Recovery''':
  * Restore files from backups if available.
 
  * Use data recovery software or consult a professional.
* Restore files from backups if available.
* Use data recovery software or consult a professional.
 
# '''Reinstall Operating System''':


* In severe cases, consider reinstalling your OS to ensure all malware is removed.
# Reinstall Operating System:
  * In severe cases, consider reinstalling your OS to ensure all malware is removed.


== Report ==
== Report ==
Line 214: Line 200:
Reporting helps prevent future incidents:
Reporting helps prevent future incidents:


# '''Contact Financial Institutions''': Inform them of any unauthorized activity.
# Contact Financial Institutions: Inform them of any unauthorized activity.
 
# Report to Law Enforcement: File a report with your local police department.
# '''Report to Law Enforcement''': File a report with your local police department.
# Notify Affected Parties: Let friends and family know if they might be impacted.
 
# File Complaints:
# '''Notify Affected Parties''': Let friends and family know if they might be impacted.
  * With the [https://reportfraud.ftc.gov/#/ FTC] for scams and fraud.
 
  * With other relevant authorities.
# '''File Complaints''':
 
* With the [https://reportfraud.ftc.gov/#/ FTC] for scams and fraud.
* With other relevant authorities.


== Learn ==
== Learn ==
Line 229: Line 211:
Understand and learn from the incident:
Understand and learn from the incident:


# '''Review What Happened''': Identify how the incident occurred.
# Review What Happened: Identify how the incident occurred.
 
# Educate Yourself: Read about best security practices.
# '''Educate Yourself''': Read about best security practices.
# Implement Preventive Measures: Update your habits and tools to enhance security.
 
# '''Implement Preventive Measures''': Update your habits and tools to enhance security.


== Monitor ==
== Monitor ==
Line 239: Line 219:
Keep an eye out to prevent future incidents:
Keep an eye out to prevent future incidents:


# '''Regularly Check Accounts''': Monitor bank statements and account activities.
# Regularly Check Accounts: Monitor bank statements and account activities.
 
# Use Monitoring Services: Consider credit and identity theft monitoring services.
# '''Use Monitoring Services''': Consider credit and identity theft monitoring services.
# Stay Updated: Follow reputable sources for security news.
 
# '''Stay Updated''': Follow reputable sources for security news.


[[Category:Cybersecurity]]
[[Category:Cybersecurity]]