1. DDoS attack Turn slides
These drive the incident along.
Change the master slides to fit your company brand or templates
This work is licensed under a Creative Commons Attribution 4.0 International License.
Remember to delete this slide!

2. Gold team exercise Date| Time
Cyber Incident
Gold team exercise
Date| Time

3. 1: Portal is down
MONDAY | 11:00 am
Main online portal on company website inaccessible since 11:00am.
Traffic seems to be targeted Distributed Denial of Service attack on us alone.
At 10:30am (before attack) sent to our FD from someone claiming to be attacker. Until ransom of $500,000 in bitcoin deposited into designated account they’ll “keep the attack up and keep (us) out of business.”
IT trying to mitigate attack. Also talking to our Internet/Cloud Service Provider and external security experts.
Hope to resolve the issue but it’s a sophisticated and heavy attack that could persist.

4. 2: Update, portal restored
MONDAY | 3:00 pm
Portal back up at 2.00 p.m. (3-hour outage).
Attack continuing and changing.
Customer traffic still slow. Some good traffic being dropped.
IT also checking to see if there’s a network breach e.g. is this a diversion to cover another attack such as an effort to extract data? No indication it is.
Noise on Twitter. Speculation we’ve been hacked, lost key data.
Media seeking comment.

5. 3: End of day Portal is up. Attack has stopped.
MONDAY | 6:00 pm
Portal is up.
Attack has stopped.
Customer traffic still somewhat slow – we have monitoring in place.
Customer traffic also increased – customers checking their access?
Monitoring will stay in place overnight in case attack resumed.

6. 4: Start of day
TUESDAY | 9:00 am
Attack relaunched at 08:30am. Portal was down for 15 mins.
Portal now back up, customer traffic still quite high but moving normally.
Media continues to cover this incident.
IT say no evidence of any unauthorised network activity.

7. 5: Update Portal still up. Attack has stopped.
TUESDAY | 11:30 am
Portal still up.
Attack has stopped.
Resumption of noise on Twitter after brief outage this morning.
Spike of mentions on media.

8. 6: End of day / Incident end
TUESDAY | 11:30 am
Portal up and normal.
Attack stopped.
No contact from attacker.

9. Incident Wrap-up

10. Questions Response Planning Processes Communications
External Threat Intelligence / ISP / Cloud support
Ransom
Bitcoins
Overall