Tutorials · Security Operations
How to Respond to a Network Security Incident: The First 60 Minutes
When ransomware, a compromised account or strange traffic is found, the first hour decides the damage. A clear, practical playbook for network and security admins.
Before you start
- An incident contact list (IT, management, legal, insurer)
- Admin access to firewall, switches, Wi-Fi and identity systems
- A notebook or ticket to log every action with the time
Step by step
Stay calm and start a log
Write down the time, who reported what, and every action you take. You will need this for management, insurers and possibly regulators.
Confirm and scope
Is it real? Which hosts, accounts and sites are involved? Check SIEM alerts, firewall logs and EDR before acting.
Contain, do not destroy
Isolate affected hosts: move their switch port to a quarantine VLAN, shut the port, or isolate them in EDR. Do NOT power them off: memory evidence is lost.
Stop the spread
Block the attacker's IPs and domains on the firewall and DNS filter, disable compromised accounts, reset their sessions and tokens, and block lateral protocols (SMB, RDP) between VLANs.
Protect backups and admin systems
Disconnect backup repositories from the network if ransomware is suspected, and check that admin accounts and the hypervisor are not compromised.
Escalate and notify
Inform management and, if needed, your incident response provider and insurer. Under NIS2, significant incidents need an early warning to the authority within 24 hours.
Preserve evidence
Export firewall, VPN, DNS and authentication logs for the incident period, and keep disk and memory images of key hosts.
Plan recovery
Rebuild from known-good images or backups, rotate credentials, patch the entry point, and monitor closely before going back to normal.
Pro tips
- Practise this playbook twice a year with a tabletop exercise.
- Keep an offline copy of network diagrams, contacts and admin credentials for emergencies.
- Prepare quarantine VLANs and firewall 'block' objects in advance.
FAQ
Frequently asked questions
Should we pay the ransom?
That is a business and legal decision. Involve management, legal counsel, your insurer and law enforcement. Payment does not guarantee recovery.
Keep learning
Related guides
Protect backups from ransomware
Read more →Build a free SIEM with Wazuh
Read more →Network disaster recovery plan
Read more →How to Set Up a WireGuard VPN Server for Remote Access
WireGuard is a fast, modern VPN with a small, auditable code base. Build a WireGuard server on Linux, add users with their own keys and route them only to the networks they need.
Read more →How to Scan Your Network for Vulnerabilities With Nmap and OpenVAS
Find open ports, outdated services and known vulnerabilities before attackers do. Discover hosts with Nmap, then run authenticated vulnerability scans with Greenbone OpenVAS and fix what matters first.
Read more →How to Build a Free SIEM With Wazuh for Network and Server Logs
A SIEM collects logs from servers, firewalls and switches in one place and alerts on attacks. Install Wazuh, add agents and syslog sources, and tune the first alerts.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.