What is an Emergency Lockout?

What is an Emergency Lockout of an IT System?

An Emergency Lockout is an action that an organization takes during a cyberattack or when a significant data breach in an IT infrastructure has been detected. In an Emergency Lockout, an organization deliberately restricts or blocks access to certain systems, accounts, or data either as a precautionary measure to prevent further damage, contain the attack, or stop attackers from gaining further control over critical systems.

Events that Trigger an Emergency Lockout

Ransomware Attacks

If an organization is hit by ransomware, an Emergency Lockout might be triggered to prevent the spread of the malicious software across the network.

Account Takeover

If there’s a suspicion that an attacker has gained unauthorized access to a user account, an Emergency Lockout could be used to suspend or lock the account until the threat is addressed.

Network Breach

In cases of a breach or intrusion, an Emergency Lockout may prevent attackers from continuing to move through the system, gaining access to more sensitive data or administrative privileges.

Components of an Emergency Lockout

Specific actions organizations typically take as part of an Emergency Lockout include:

Disconnect Affected Devices from the Network

Devices that could be disconnected include computers, servers, and even mobile devices. This isoIates compromised systems by disconnecting them from the organization’s network to prevent the attack from If an organization suspect ransomware or malware, they should immediately unplug the device and disable Wi-Fi or other connections.

Evidence Preservation

As part of an Emergency Lockout plan, organizations should take steps to avoid deleting files or making changes to affected systems. Instead, they document the attack by taking screenshots, saving error messages, and logging unusual activity. Preserving this evidence is essential for forensic investigations, identifying the source of the breach, and potentially pursuing legal action.

Stakeholder Alerts

Organizations inform employees, contractors, partners, vendors, and customers about the Emergency Lockout. Clear, transparent communication is crucial to prevent panic and ensure everyone knows how to respond.

Other systemic actions include taking back-up servers offline, powering the domain controller off, and changing network shares to read-only.

What do to after an Emergency Lockout

Contain the Breach

Malicious actors design passive attacks to include a persistent backdoor into an organization’s IT infrastructure, so they can continue to exfiltrate sensitive data over time. It’s important to identify and shut down all access the attackers may have to your system. This is also true for an active attack. In all cases, it is critical to totally deny the attackers access to your system.

Assess and Repair the Damage

Once an attack has been contained, organizations must determine which (if any) critical business functions have been compromised, what data has been affected by the breach, which systems have been subjected to unauthorized access, and whether any unauthorized entry points remain. Systems may need to be reinstalled, compromised data may need to be restored from backup copies, and any damaged hardware repaired or replaced.

Change All Passwords and Harden Organizational Security

As soon as the immediate threat is neutralized, IT teams and users must update passwords for all systems, devices, and accounts. Use strong, unique passwords and implement multi-factor authentication (MFA) to ensure that hackers cannot re-enter your systems using previously compromised credentials.

Assign Responsibilities and Ownership

Appoint a Cyber Incident Owner and keep an action log, decision log and priority list for protection and recovery during the whole incident. You should record the times that commands were run, and what activities were undertaken.

Leverage Authorities and Regulators

The purpose of compliance rules is to help organizations safely minimize the damage of a security incident and process lessons learned to prevent similar attacks in the future. Be truthful and honest, accurate and realistic.

By proactively implementing robust security measures, organizations can significantly reduce the risk of a data breach and avoid having to implement an Emergency Lockout. Learn more.