The first hour is about not closing doors

Why memory matters more than the disk

The disk survives a power cut. Memory does not, and memory is where the answers are. A running compromised machine holds the processes actually executing, the network connections currently open, the credentials in use, code that never touched storage at all, and — in ransomware cases — sometimes the encryption key itself, sitting in RAM because the software needed it there to do its work.

There are documented cases of recovery achieved from a key recovered out of memory on a machine that had not been restarted. There are far more cases where that possibility was destroyed in the first ten minutes by somebody who did the sensible thing and rebooted. The margin is the interval between noticing and reacting, which is why capturing an image is placed above almost everything else in modern guidance.

The practical objection is that most firms have no tooling to capture memory and nobody who has done it. That is fair and it has a simple answer: leave the machine on, take it off the network, and let whoever arrives do the capture. Doing nothing is a legitimate action here, and the composure required to do nothing while a screen shows a ransom note is considerable — which is the argument for having decided in advance rather than deciding then.

One structural point belongs here and is routinely discovered too late. In several jurisdictions an investigation commissioned through counsel may attract legal privilege, while the identical work commissioned directly by the technology department may be disclosable in later litigation — including the candid internal assessment of what went wrong. Courts have declined privilege where the report was plainly an ordinary business document dressed up afterwards, so the arrangement has to be genuine and made at the outset. Alongside that sits the litigation hold: once proceedings are reasonably anticipated, routine deletion schedules must be suspended, which collides awkwardly with the retention policies discussed elsewhere on this site. Neither of these is a technical matter, both are decided in the opening hours, and neither is something the responder in front of the keyboard should be improvising.

What a plan is actually worth

Firms with a tested incident response plan average roughly $2.66m less per breach than those without one. That is among the largest single effects in the whole literature on security spending, and it attaches to a document and a rehearsal rather than to a product.

The load-bearing word is tested. Around 37% of organisations have exercised their plan in the past twelve months, which means most plans have never been run. An untested plan reliably contains at least one step that cannot be performed during an incident: a contact list maintained by somebody who left, an escalation path through a system that would also be down, a procedure that assumes access to the wiki, or an approval from a person with no delegate.

A tabletop finds these for the price of an afternoon. Somebody describes an unfolding situation, the colleagues who would handle it say what they would do, and the exercise stops every time an answer turns out to be unavailable. The failures found this way are almost always mundane and almost always fatal to the timeline: nobody knows who can authorise stopping trading, the out-of-hours number reaches a desk, the insurer must be notified within a window nobody had read.

The other reason to rehearse is that the people involved will otherwise meet each other for the first time during the worst week of their professional lives. Legal, communications, operations and technology have different vocabularies and different instincts, and discovering that at two in the morning costs hours that the measurement above prices rather precisely.

When is an incident over?

Not when the systems are back, which is the answer most organisations use because it is the one the business is asking about. Systems returning is the juncture at which the pressure drops and the remaining questions become easy to postpone indefinitely.

Four things have to be true. You know how they got in. That route is closed. Nothing they established to get back — an account, a scheduled task, a key, a rule that forwards mail — is still in place. And you can state what data was involved, because that determines obligations that do not expire when the servers come up.

Firms that declare victory on the first condition alone meet the same adversary again, frequently within weeks and occasionally with the same credentials. It is a well-documented pattern and an entirely predictable one: an episode that was profitable once, against an organisation that removed the symptom rather than the access, is an obvious place to return to.

There is also a fifth condition that few organisations enforce and everybody benefits from: writing down what happened while people still remember, including the parts that went badly. The value is not the document. It is that the discussion happens at all, and that the next tabletop rehearses a genuine scenario instead of an imagined one, which participants find markedly more persuasive and considerably harder to dismiss.

The evidence you will wish you had kept

Every investigation eventually runs into the same wall: the logs do not go back far enough. With intrusions typically discovered around six months after they began, a retention window of thirty or ninety days guarantees that the interesting period has already rotated away by the time anybody looks for it.

Three sources answer most questions and are cheap to keep. Authentication records show who signed in from where, which is how the first foothold is usually found. Administrative actions show what changed and by whom, which is how persistence gets discovered. Network egress records show what left, which is what determines whether this is an intrusion or a data breach — a distinction that decides your notification obligations and therefore most of the cost.

What tends to be kept instead is whatever the tools produce by default, retained for whatever period the licence includes, which is a decision made by a pricing model and not by anybody thinking about investigations. Storing the three categories above for a year, in a place the intruder cannot reach and separate from the systems that generate them, costs very little and changes what can be established afterwards.

The separate copy matters as much as the retention. An intruder with administrative access clears their traces, and logs that live only on the compromised system are logs the compromise can edit. Shipping them somewhere append-only is unglamorous plumbing that determines whether the eventual report says what happened or concedes it could not be established.

Whoever handles the copies should keep a chain of custody: who took each image, at what hour, from which machine, and a cryptographic checksum demonstrating nothing was altered afterwards. Investigators call that provenance and courts call it admissibility. Both are trivially cheap to establish while the work is happening and genuinely impossible to reconstruct once a fortnight has passed, which is why the practice belongs in the plan and not in the memory of whoever happened to be on shift.