Security Incidents: Detect, Report, and Respond
Key steps when spotting a security incident: isolate the device, report immediately, preserve evidence, and understand incident response.
Why It Matters
Every organization will experience a security incident at some point. The difference lies in how early it is detected and what actions are taken during the critical first hours.
The Basics
Suspicious signs: Unfamiliar login alerts; a password suddenly failing to work; pop-up windows appearing out of nowhere; modified file names and extensions; a client mentioning they received an unusual email from you; or unrecognized transactions and activity on your account.
Immediate steps for employees:
- Stay calm and stop. Do not continue the current activity.
- Disconnect the device from the network (turn off Wi-Fi, unplug the Ethernet cable); do not shut down the computer, as critical forensic evidence resides in volatile memory (RAM).
- Report it immediately: Contact your organization's security or IT team through designated channels. Take note of what you observed, the time, and any actions you took.
- Do not delete evidence: Keep suspicious emails intact and take screenshots where relevant.
- Change your password from a different, clean device (coordinating with IT if necessary).
The organization's incident response process (in brief): preparation → detection and analysis → containment → eradication/remediation → recovery (restoring from backups) → post-incident review ("what needs to change to prevent this from happening again?"). If personal data is compromised, notify data protection authorities (such as KVKK); if fraud or illegal activity is detected, file a report with law enforcement and the prosecutor's office. At the national level, USOM and sectoral SOME teams (Computer Emergency Response Teams) provide assistance during incidents.
In cases of personal fraud: Call your bank immediately using the number on the back of your card, cancel or freeze your cards, update your e-government and email passwords, and report the issue to law enforcement (cybercrime unit) or the prosecutor's office.
A Realistic Example
An employee opens a folder in the morning and notices strange extensions appended to file names. They immediately disconnect the network cable and call IT. The ransomware remains confined to that single workstation, sparing the network servers.
Action Items
- Save the answer to "Who do I call in an incident?" directly on your phone.
- Ensure the organization maintains a concise, one-page plan outlining who does what during an incident.
- Conduct a brief simulation drill once a year.
Key takeaway: The first hour determines the following week.
*This post is part 13 of the 14-part Cybersecurity Awareness series.* Next up: Where to follow current threats.