Digital Security Incident Runbook

Digital Security Incident procedures for handling account compromises, device theft, or system access loss while maintaining operational security.

Immediate Response (First 15 minutes)

Step 1: Isolate and Assess

1. Disconnect all compromised devices from internet immediately
2. Activate airplane mode on mobile devices
3. Do not attempt to "fix" compromised accounts from potentially infected devices
4. Use clean device or secure location to access accounts

Step 2: Rapid Account Securing

Priority Order:

1. Primary email account password reset
2. Banking and financial accounts security check
3. Social media and communication platform lockdown
4. Cloud storage and backup service access verification
5. Work-related accounts and systems security review

Step 3: Communication Lockdown

1. Change passwords on all critical communication channels
2. Enable two-factor authentication on newly secured accounts
3. Log out all devices/sessions on compromised accounts
4. Activate backup communication methods with trusted contacts

Recovery Procedures

Account Restoration

1. Use pre-configured recovery email or phone numbers
2. Employ offline authentication methods when available
3. Contact platform support with identity verification if needed
4. Document which accounts were compromised vs. still secure

Alternative Access Methods

1. Activate secondary devices with clean OS installation
2. Use public computer with secure boot media if necessary
3. Employ backup authentication devices (hardware keys, etc.)
4. Access accounts through trusted contacts if account sharing exists

Data Protection

1. Remote wipe compromised devices using cloud management tools
2. Change encryption keys on sensitive file storage
3. Audit recent account activity for unauthorized access
4. Secure offline backup access for critical data recovery

Source and Contact Protection

If Sources May Be Compromised

1. Use secure communication methods to warn sources immediately
2. Employ pre-arranged emergency contact protocols
3. Switch to backup communication channels established in advance
4. Document timeline of compromise to assess potential source exposure

Professional Communication

1. Notify editors/clients of potential story timeline impacts
2. Use alternative communication methods to maintain work flow
3. Activate backup publishing platforms if primary access is compromised
4. Implement backup byline/attribution methods if identity verification is affected

System Restoration

Clean Device Setup

1. Restore systems from known-good backups created before compromise
2. Use clean OS installation on recovered or replacement devices
3. Implement enhanced security measures during restoration
4. Verify all software and accounts before returning to full operation

Security Enhancement

1. Enable additional authentication factors on all restored accounts
2. Implement new password management with longer, unique passwords
3. Configure enhanced monitoring and alerting for future incidents
4. Review and update security protocols based on compromise method

Prevention and Preparation

Pre-Incident Security

• Regular backup of authentication codes and recovery keys
• Maintain offline copies of critical account recovery information
• Test alternative access methods quarterly
• Keep clean backup devices updated and accessible

Communication Planning

• Establish backup communication methods with all critical contacts
• Create encrypted contact lists stored in multiple secure locations
• Develop code words or verification methods for emergency communications
• Maintain relationships with technical support contacts at critical platforms

Follow-Up Security Review

Incident Analysis

• Document attack vector and timeline of compromise
• Identify security gaps that enabled the incident
• Review effectiveness of response procedures
• Update security protocols based on lessons learned

Ongoing Monitoring

• Monitor restored accounts for unusual activity
• Set up enhanced alerting for suspicious login attempts
• Review account activity logs regularly for first 30 days
• Maintain elevated security posture until confident in system integrity