About This Tool
What this tool does
The Incident Response Playbook is a structured guide for handling security incidents — from a suspected hacked account to a malware infection on a family computer or small-business network. When something goes wrong, panic and guesswork make things worse; a playbook gives you calm, ordered steps.
It follows the standard incident response phases used by security professionals: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Each phase has clear actions adapted for non-experts, so you know what to do first, what to preserve, and when to call for help.
It is for home users, freelancers, parents, and small teams without a dedicated security department. This is defensive work: protecting your own systems, preserving evidence properly, and recovering safely. If a crime occurred, the playbook also notes when to involve law enforcement.
How to use it
- Prepare now: write down key contacts (your ISP, bank fraud line, a trusted tech-savvy person), and make sure backups are current before any incident.
- Detect: learn the signs — unfamiliar logins, changed passwords, ransom notes, antivirus alerts, or devices behaving strangely.
- Contain: disconnect the affected device from the network to stop the spread, but avoid turning it off if investigators may need its memory.
- Analyze: note what happened and when. Take photos of ransom notes or error messages with another device.
- Eradicate and recover: remove the cause (often by wiping and reinstalling), change all passwords from a clean device, and restore data from known-good backups.
- Learn: write down what happened and what you will change — then actually change it.
Defensive security tips
- Preserve evidence. Do not delete logs, ransom notes, or suspicious emails. Screenshots and notes help both your recovery and any report to authorities.
- Change passwords from a clean device. Resetting passwords from the compromised machine can hand the new ones straight to the attacker.
- Contain before you clean. Disconnecting first prevents the incident from spreading to other devices while you figure out what happened.
- Know your escalation points. Banks have fraud lines, email providers have account-recovery flows, and police take cybercrime reports. Save these numbers before you need them.
- Practice the plan. A playbook nobody has read is just a document. Walk through it once with your family or team so the steps feel familiar.
FAQs
What counts as a security incident?
Any event suggesting your security was breached: an account you cannot access, a ransom message, antivirus finding malware, money moving without your action, or contacts receiving strange messages from your accounts.
Should I turn off an infected computer?
If ransomware is actively encrypting, disconnecting from the network matters more than powering off. For investigation purposes, memory contents are lost on shutdown, so disconnect first and decide about power with help if the incident is serious.
When should I contact law enforcement?
When a crime occurred — theft, fraud, extortion, or unauthorized access to your systems. Reporting also helps authorities track criminal campaigns and warn others.
Do I need this if I am 'just' a home user?
Yes. Home users face phishing, ransomware, and account takeovers too, and a short written plan turns a panicked evening into a manageable procedure.