The First Hour of an Incident

Pulling the power feels decisive and is almost always the wrong move. Volatile memory holds the things you will want most in six hours: encryption keys, injected processes, live network connections, credentials in use, and malware that exists nowhere on disk. Some ransomware strains keep their keys in memory right up until the machine restarts. Power the box off and that material is gone permanently.

The correct move is to cut the network, not the power. If you run an EDR platform, use its network containment feature; it severs everything except the management channel, which keeps your visibility intact. Failing that, disable the switch port, drop the machine from Wi-Fi, or physically unplug the cable. The machine stays on, isolated, and available for a memory capture.

The same logic applies off the desktop. In Azure, snapshot the disk before you touch anything, then isolate the VM with network security group rules rather than deleting it. For a compromised identity, revoke sessions and refresh tokens in Entra ID and disable sign-in rather than deleting the account: deletion erases the audit trail and breaks every correlation you will need when you reconstruct what the account touched.

Log retention runs on fixed schedules that do not care you are having an incident. Entra ID sign-in logs are kept for seven days on the free tier and thirty days with a P1 or P2 licence unless you have already shipped them somewhere else. Firewall and VPN appliances often hold days, not weeks. If the intrusion started three weeks ago, the evidence of initial access may be days from ageing out while you deliberate. Export sign-in logs, audit logs and perimeter logs now, to storage the attacker cannot reach, even if you never end up needing them.

At the same time, start an incident log. A plain document, kept outside the compromised environment, recording in UTC who did what, when, and what they observed. Photograph ransom notes and anything strange on screen with a phone rather than screenshots on the affected machine. If the matter ends up in front of your insurer, a regulator or a court, the discipline of a contemporaneous record and a clean chain of custody is worth more than any forensic tool. It is also the raw material for the breach assessment the Privacy Act will require of you later.

The first call is internal: whoever holds the authority to take a revenue system offline and to spend money without a committee. Incident response is a business function wearing technical clothes, and the costliest delays happen while engineers wait for permission nobody in the room can grant.

The second call is your cyber insurer, and it should come earlier than most people expect. Many policies require the insurer to be notified before external responders are engaged, and most operate panels of approved forensic and legal firms. Engaging your own responder first can complicate or jeopardise cover. The policy number and the insurer's incident hotline belong on paper, in the plan, not in a mailbox you may no longer trust.

Then the external machinery. Engage forensic investigators through legal counsel where you want any prospect of privilege over the findings; Australian courts have declined privilege claims over breach reports commissioned for mixed business purposes, so the structure of the engagement matters more than the label on it. Report the incident to the ACSC through ReportCyber. If personal information is likely involved, the Notifiable Data Breaches scheme under the Privacy Act 1988 gives you up to thirty days to assess whether an eligible data breach has occurred, and once you form that belief, notification to the OAIC and affected individuals must follow as soon as practicable. And if the incident ends in a ransom payment, the Cyber Security Act 2024 requires businesses above the small business turnover threshold to report the payment within seventy-two hours.

First: does the revenue system come offline? This is the decision people avoid in the moment, so make it in advance. Agree the thresholds while nobody is under pressure: what evidence of spread justifies disconnecting the platform that makes the money, and who says go. A pre-agreed threshold turns an agonising judgement call into a procedure.

Second: when do credentials rotate? The reflex is to reset the obviously compromised password immediately, and it is usually wrong. A modern intruder persists beyond the password: inbox rules that forward mail, OAuth application grants, freshly registered MFA methods, service principal secrets. Reset one credential and you tell the attacker you are onto them while leaving their other doors open. The stronger play is to scope first, then rotate broadly and at once, paired with session and token revocation, so there is no quiet corner left to retreat to. Until then, the fact that they do not know you know is the only advantage you hold. Spend it deliberately.

Third: where does the response team talk? Assume the attacker reads the mailbox until proven otherwise. Coordinating the response inside the compromised tenant hands them your containment plan in real time. Move to out-of-band channels immediately: phones, a messaging group on personal devices, or a clean tenant kept for exactly this purpose.

The plan that survives contact with a real incident is short enough to use at 2am. One page, printed, in a drawer as well as a drive:

Then rehearse it. A one-hour tabletop twice a year, walking a plausible scenario against the page, surfaces every stale phone number and every unowned decision at a cost of nothing. Pair it with a genuinely tested restore, because the Essential Eight's regular backups strategy quietly assumes recovery has been proven rather than presumed. Writing and rehearsing exactly this kind of plan is standing work in Black Shard's vCISO engagements, because rehearsal is the mechanism that converts judgement calls into procedure.

The test worth applying today is simple. Could your most junior on-call person, alone at 2am, isolate a machine without powering it off, find the incident log template, and name the first three phone calls? If the answer is yes, your first hour will be boring, and boring first hours are the entire point. This note is general information, not legal advice; take counsel on your organisation's specific obligations.