What is a cyber attack and why the risk is higher today
A cyber attack is any deliberate attempt to gain unauthorised access to your information systems, steal or alter data, or disrupt your services. Medium-sized and large companies are attractive to attackers because they can afford to pay a ransom, yet often lack a security team that works around the clock.
Attacks today are mostly organised and automated. Attackers buy stolen passwords or network access, move quietly through your systems for days or weeks, delete or encrypt backups first and only then launch ransomware. That is why readiness depends less on any single product than on whether the basics are in order. Assess your readiness with the tool on this page.
The most common types of attack
| Type of attack | How it works | Key protection |
|---|---|---|
| Ransomware | Encrypts systems and often steals data, with a threat to publish it | Immutable backups, tested recovery, network segmentation |
| Phishing | A fake email or site tricks the user into giving up a password or installing malware | MFA, email filtering, staff training |
| Business email compromise (BEC) | The attacker poses as an executive or supplier and requests a payment | Payment verification through a second channel, MFA |
| Vulnerability exploitation | Attacks on unpatched internet-facing systems (VPN, firewall, web server) | Vulnerability management, fast patching |
| Supply chain attack | Intrusion through a contractor’s remote access or software | Control of supplier access, contractual security requirements |
| DDoS | Overloads a service until it becomes unavailable | Protection at the network or cloud provider |
Five areas of readiness
The tool on this page assesses readiness across five areas that prove decisive in practice, and that any serious incident response plan has to cover.
- Governance and accountability. Someone must own security and report on risk to management regularly. Without an inventory of critical systems you do not know what to protect and restore first.
- Backup and recovery. The 3-2-1 rule (three copies, two media, one copy elsewhere) is the foundation. What matters is that at least one copy is immutable or physically separate and that you test recovery regularly. A backup you have never test-restored is only an assumption.
- Identities and access. Multi-factor authentication (MFA) for email, remote access and cloud stops most attacks that use stolen passwords. Administrator accounts must be separate and monitored.
- Detection and response. Centralised logs, 24/7 monitoring and a rehearsed response plan shorten the time from intrusion to detection. That time has the biggest effect on the extent of damage.
- People. Regular, short training and phishing simulations reduce successful scams, and a simple way to report suspicious email enables fast action.
Backups: the last line of defence
When every other control fails, backups decide whether you can restore the business. Attackers know this, so deleting or encrypting backups is now one of the first steps of an attack. If the attacker has domain administrator access and reaches the backup server, the copies are at risk too.
- Immutability. Keep at least one copy stored so that it cannot be changed or deleted for a set period, even with administrator rights. The alternative is a physically separated copy (air gap).
- Separate credentials. The backup system should not sit in the same domain as production, and access should be protected with MFA.
- Second location. A copy in another data centre or in the cloud also protects against fire, flood or site outage.
- Tested recovery. Regularly verify that you can restore entire systems, not just individual files, and how long it takes. Compare the result with how much downtime the business can tolerate.
- Recovery order. Decide in advance which systems come back first. Typically that is identity, the network, core business applications and communications.
The role of management
A cyber attack is not only a technical incident. During it, business decisions must be made quickly: which services to shut down, how to inform customers and partners, whether to bring in external experts, how to communicate with the media and when to report to authorities. Management makes these decisions, so it must be involved in preparation and exercises.
Good practice is for management to take part in a tabletop exercise at least once a year, in which the team plays through a ransomware scenario. It quickly exposes missing contacts, unclear responsibilities and assumptions that do not hold. For organisations in scope of NIS2, management training is also a legal obligation.
The first 72 hours after a cyber attack
The first hours decide whether an incident stays manageable. The framework below is generic. Adapt it to your own cyber attack response plan and to the reporting rules of each country where you operate.
| Time | Key steps |
|---|---|
| First hour | Activate the response team and inform management. Isolate infected systems from the network, but do not power them off or wipe them. Disable compromised accounts and remote access. |
| Within 24 hours | Assess the scope: which systems and data are affected, and whether backups are intact. Preserve logs and evidence. Entities in scope of NIS2 send the early warning. Decide how to communicate with staff and customers. |
| Within 72 hours | Entities in scope of NIS2 send the incident notification with an initial assessment. For a personal data breach, notify the data protection authority. Start restoring key systems from verified clean copies, in the order set in your plan. |
| After 72 hours | Remove the root cause (vulnerability, stolen credentials), strengthen monitoring and prepare the final report and a list of improvements. |
Report the incident to your national CSIRT, which can also offer technical help. Report criminal offences such as extortion to the police. Authorities advise against paying a ransom, because it does not guarantee the return of data and funds new attacks.
Regulation: NIS2 and data protection
For many medium-sized and large companies, preparing for an attack is no longer only good practice but a legal obligation. The NIS2 Directive, transposed into national law in each member state, requires in-scope entities to apply risk management measures and to report significant incidents within 24 hours, 72 hours and one month. To find out whether you are in scope, see the guide NIS2 directive.
If personal data is affected, the General Data Protection Regulation (GDPR) requires notification of the supervisory authority within 72 hours, and in some cases notification of the individuals concerned.
Where to start
- Complete the readiness assessment and start with the three suggested actions.
- Check that at least one backup is immutable and that you have tested a restore in the last six months.
- Roll out MFA everywhere access is possible from the internet.
- Prepare a short incident response plan with contacts and test it with a management exercise.
As a Veeam Silver partner, Humanfrog provides backup with immutable copies in TIER III data centres and helps with MFA, managed security services and incident response plans. To review your assessment with an expert, write to us.
