A cyberattack has been detected, and multiple endpoints may already be affected. Every decision counts now. Rash actions can not only facilitate the spread of an attack but also destroy vital evidence and complicate subsequent recovery.
The following dos and don'ts outline the most important immediate measures to take during a cyberattack on endpoints.
The essentials at a glance
- Rapid isolation: In the event of a cyberattack, affected endpoints should be isolated from the network as quickly as possible to prevent the attack from spreading further.
- No unauthorized intervention: Devices should not be shut down, restarted, or reset without authorization, as this can result in the loss of important forensic evidence.
- Clear emergency plans: A simple, well-known, and regularly tested incident response plan helps ensure coordinated action, even under time pressure. This is especially critical for large, distributed endpoint environments.
1 Dos: Immediate measures you should take during a cyberattack
If a cyberattack has been detected or there is a suspicion that an endpoint has been compromised, the following measures are essential:
- Disconnect from Wi-Fi: Disconnect the affected device from the Wi-Fi to prevent further network communication. The same applies to LAN connections for wired devices. Carry out the isolation according to the guidelines provided by your incident response team.
- Disconnect VPN: Terminate active VPN connections if this has not already been handled by network isolation. This prevents a potentially compromised endpoint from continuing to communicate with corporate resources via the VPN.
- Block outgoing internet connections: Ensure that affected devices cannot establish any further connections to the internet. Ideally, isolation should be performed centrally via existing security or network management solutions.
- Maintain secure communication channels: Ensure that communication between IT, the incident response team, and affected employees remains functional. Use trusted, non-compromised devices and, if necessary, alternative communication channels.
- Keep cameras on during crisis meetings: Especially during a cyberattack, it is important to ensure that the right people are participating in the meeting. Turning on cameras helps to visually verify participants and makes identity fraud more difficult. This assumes that communication is taking place via trusted devices and secure channels.
- Follow the incident response team's instructions: Strictly adhere to the prescribed measures. Independent actions can exacerbate the security incident or complicate subsequent investigations.
In any case, the incident response plan should be followed. Above all, such an emergency plan must be simple and clear. Basically, there are three types:
- Either there is none at all,
- a 5,000-page document that no one knows exists—let alone what is in it
- or a simple, clearly defined plan that is known to everyone involved, has been regularly tested, and is proven to work.
It should be clear which version helps in an emergency. The key is to have short, understandable instructions that everyone knows and can reliably execute even under time pressure.
2 Don’ts: Mistakes to avoid with affected endpoints
It is not just the right immediate measures that are crucial. It is equally important to refrain from certain actions.
If an endpoint may have been compromised, you should avoid the following:
- Turning on devices without authorization: Do not turn on powered-off endpoints without approval. This can cause malware to become active again or alter relevant evidence.
- Turning off devices without authorization: Do not shut down powered-on devices without authorization. Turning them off can result in the loss of important information from the RAM that is needed for forensic analysis.
- Moving devices unnecessarily: Keep affected endpoints at their location if possible. Transporting them can complicate investigation and documentation, especially if connections or the device state are altered in the process.
- Attempting independent repairs: Do not attempt to remove malware yourself, run security tools, or change system settings. Such interventions can alter evidence and make root cause analysis more difficult.
- Reinstalling Windows without authorization: Even if a reinstallation seems like a quick fix, compromised devices must not be reset without authorization. First, it must be determined which information needs to be secured for the investigation.
- Connecting affected devices to secure networks: Do not connect potentially compromised endpoints to other corporate networks or isolated recovery environments. Otherwise, you risk endangering systems that have not yet been affected.
- Using tethering or mobile hotspots: Do not bypass a network block by connecting to a smartphone or other internet access point. Doing so could unintentionally lift the isolation of the affected endpoint.
The responsible incident response team decides whether a device may be switched off, examined, or reinstalled based on the specific threat situation. If an active attack cannot be contained in any other way, a controlled shutdown may also be necessary.
The background: Affected endpoints can contain valuable digital evidence. This includes, for example, running processes, network connections, log data, or information in the system memory. If these are altered or deleted through uncoordinated intervention, investigating the security incident can become significantly more difficult.
3 Why endpoints are particularly challenging during a cyberattack
Compared to centrally managed servers, endpoints present companies with unique challenges. This is primarily due to their number, their distribution, their technical diversity, and the direct involvement of users.
- Number: Companies often have thousands or tens of thousands of endpoints. In the event of a major cyberattack, numerous devices may need to be isolated, examined, and subsequently restored simultaneously.
- Distribution: End devices are no longer used exclusively in the office. Employees access corporate resources from various locations. As a result, affected devices cannot always be reached immediately by central IT or physically disconnected from the network.
- Device diversity: Heterogeneity makes responding to a security incident more difficult. Not every device can be isolated, examined, or restored in the same way.
- Users: Unlike many servers, there is an employee behind almost every endpoint who relies on that device. Consequently, an attack directly impacts the employees' ability to work.
In addition to technical measures, IT teams must therefore consider issues regarding communication, compliance requirements, prioritization, and support.
Especially under time pressure, it is crucial that all involved parties know which measures are permitted, which they must avoid, and who they can turn to.
4 Conclusion: A clear endpoint strategy counts in an emergency
In the event of a cyberattack, it is not about carrying out as many measures as possible at the same time. What matters is implementing the right steps in the right order and avoiding unauthorized interventions.
Clear dos and don'ts help to isolate affected endpoints in a controlled manner, preserve forensic evidence, and support further processing by the incident response team.
For these measures to work effectively across a large, distributed fleet of devices, you need not only a tested emergency plan but also structured and consistent endpoint management.
SOFTTAILOR supports you in Endpoint Management as a Service continuously managing and securing your devices while sustainably improving your endpoint strategy. This creates the essential technical foundation to ensure you are prepared for security incidents.
Dorian has been involved in corporate and IT strategy since 2011. Due to the endpoint security deficiencies of many companies and the information overload, he developed the endpoint strategy. Dorian is co-founder of the “Endpoint Management” expert group at IAMCP e.V.
Years of Experience
Managed Endpoints
