Cyber Incident Response Guide (Personal)

Cyber Incident Guide for Personal Use

Prevention is the best option! The [Digital Force Protection Guide|dfp-guide] can help you prevent this from happening as well as preparing backups for recovery.

Reacting to a potential cyber incident on personal devices, accounts, and networks

Identify the incident

The first step in responding to a cyber incident is identifying what happened. The steps you take may vary depending on the nature of the incident. Here are some guidelines to help you identify different types of cyber incidents:

• Monitor
• Identify
• Secure
• Restore
• Report
• Learn
• Monitor

Possible Hack

• Return to: Identify the Incident

HACK: Online

• Return to: Identify the Incident

Q: Are you locked out of your account?

• If YES: Jump to Secure Online Accounts section.

Q: Is your financial account missing money?

• If YES: Jump to Secure Online Accounts section.

Q: Are there changes or activities in your accounts that you didn't make?

• If YES: Jump to Secure Online Accounts section.

HACK: Local

• Return to: Identify the Incident

Q: Has your mouse moved or computer turned on without your control?

• If YES: Jump to Secure Local Devices section.

Q: Did you get a ransomware message?

• If YES: Jump to Secure Local Devices section.

Q: Did you get a fake anti-virus or update message?

• If YES: Jump to Secure Local Devices section.

Q: Have you noticed a plugin, toolbar, or application installed that you did not install?

• If YES: Jump to Secure Local Devices section.

Q: Is your device running slowly or behaving abnormally?

• If YES: Jump to Secure Local Devices section.

Q: Pop-ups on the computer?

• If YES: Jump to Secure Local Devices section.

Q: Are your internet searches being redirected?

• If YES: Jump to Secure Local Devices section.

LEAK

• Return to: Identify the Incident

Q: Is your private information, like photos or personal details, shared online without your permission?

• If YES: Alert family and friends to the leak and advise them to be cautious of anyone attempting to pretend to be you.
• Freeze your credit report to prevent identity theft.

Q: Have personal images, video, or other media been shared online without your permission?

• If YES: Do not engage with the leaker. Identify the source of the leak and lock down the source of the leak. Identify the content that has been leaked. Identify direct links to the leaked content and store them for future reference.

BREACH

• Return to: Identify the Incident

Q: Suspect Data Breach?

• If YES:
  • Check your email on [1]
  • Jump to Secure Online Accounts section.

Q: Have you received any notifications from companies or organizations about a hack of their systems?

• If YES: Jump to Secure Online Accounts section.

PHISHING

• Return to: Identify the Incident

Q: Did you receive an email or message requesting personal or financial information?

• If YES: Mark the email as spam and delete it.

Q: Did you click on a suspicious link or download an attachment from an unknown source?

• If YES: Jump to Secure Your Devices and Network section.

SCAM

Q: Did someone request money or your banking information from you?

• If YES: Be cautious. Read about finance scams.
• Scammers may pressure you with fear, desire, stress, greed, and other emotions to lower your guard.

Q: Did you send money to the scammer?

• If YES: Consider the money gone, and do not pay the scammer again. Report the incident to the local police department and a complaint with the FTC.

Q: Did you install anything from the scammer?

• If YES: Jump to Secure Your Devices and Network section.

Q: Did you give the scammer any personal or sensitive information?

• If YES: Immediately report the incident to the local police department and a complaint with the FTC.

ACCIDENT

• Return to: Identify the Incident

Q: Has your device been stolen?

• If YES: Immediately change all passwords for your accounts and enable two-factor authentication for all your accounts connected to the device. Attempt to locate the device using a tracking app or service. Consider factory resetting the device and wiping all data if necessary.

Q: Did you accidentally delete important files or information?

• If YES: Refer to the Restore section for steps on data recovery.

Secure

After identifying the nature of the cyber incident, take the necessary steps to secure your digital environment. Return to Identify the Incident for further guidance.

Online Accounts

Secure your online accounts immediately by taking the following steps:

• Change Passwords: Update passwords for all critical accounts and store using a /resources/guides/dfp-guide/password-manager.
• Enable Multi-Factor Authentication: Enhance security by enabling MFA. For guidance, see our /resources/guides/dfp-guide/mfa-guide#how-to-enable-mfa.
• Search for a Data Breach: Check your email on [2]; change authentication to any accounts identified or any accounts using the same password as the account in question.
• Specific Accounts to Secure:
  • Email Accounts: Prioritize accounts used for account recovery.
  • Finance and Banking: High-value targets, especially crypto accounts.
  • Mobile Carrier: Secure to prevent SIM swapping.
  • Social Media: Prevent impersonation and fraud.

• Remove Online Data Opt-Out Lists [3].

Review additional measures in the Online Account Hack section.

Local Devices

Take immediate action to secure and analyze your local devices:

1. Disconnect from the Internet: Stop further unauthorized access.
2. Run a Malware Scan: Check for and remove any malicious software.
3. Log Review: Investigate security logs for any signs of compromise. /resources/guides/incident-response-guide/searching-log-files.md.

For more details, see the Local Hack section.

Network Security

See the router-hardening.

Ensure your network devices are secure by performing the following:

1. Password Update: Change passwords for routers and Wi-Fi networks.
2. Firmware Update: Keep your network devices updated with the latest firmware.
3. Disable Remote Management: Prevent external access to your network devices.
4. Monitor Traffic: Watch for unusual activity that might indicate a breach.

Identify and Lock Down

Increase your defense against identity theft:

1. Credit Lock: Freeze your credit with major credit bureaus to prevent new account openings. https://inteltechniques.com/freeze.html.
2. Review Digital Footprint: Check all online accounts for unauthorized access or transactions. https://github.com/yaelwrites/Big-Ass-Data-Broker-Opt-Out-List.

1. Security Settings: Update and strengthen security settings on all connected devices.

Restore

Recover from a cyber incident by restoring compromised systems and accounts:

1. Account Recovery: Reset passwords and set up MFA. Consider using masked emails for sensitive accounts. /resources/guides/dfp-guide/password-manager. /resources/guides/dfp-guide/mfa-guide#how-to-enable-mfa.
2. Data Recovery: Restore data from backups or use professional data recovery services if necessary.
3. System Reinstallation: In cases of severe malware infection, reinstalling the operating system on affected devices may be required.

Report

It’s crucial to report any cyber incident to help prevent future occurrences:

1. Financial Institutions: Inform your bank or credit card issuer about any unauthorized transactions.
2. Law Enforcement: Report identity theft and other cybercrimes to the police.
3. Notify Affected Parties: If others are impacted by the breach, inform them to take protective measures.

Learn

Enhance your knowledge and preparedness for future incidents:

• Incident Review: Understand what happened and why. ./incident-response-guide/learning-from-incident.