5.2 Steps to Contain and Report
-
The “Golden Hour”:
The first 60 minutes determine the damage.-
Disconnect:
Unplug the ethernet cable. Turn off Wi-Fi. (Do NOT shut down—this destroys RAM evidence). -
Document:
Note the time, what you were doing, and take photos of the screen (don’t take screenshots on the infected machine). -
Report:
Call the SOC (Security Operations Center) or IT Emergency Line immediately.
-