Lessons · IT support · when a ticket is a security incident
When a ticket stops being yours: the security incident
A ticket becomes a security incident the moment there is a sign that somebody unauthorised has, or may have, access: a password typed into a fake page, a ransom note, a device nobody recognises, a sign-in from the wrong country, data sent to the wrong person. From that moment the job is to preserve, isolate and report, not to fix.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
A user's screen shows a note demanding payment and a countdown. The helpful instinct is to power off, or to start deleting things, or to run a cleanup tool. Every one of those destroys the evidence the security team needs and can spread the damage. Pulling the network cable and picking up the phone is the whole of your job in that minute.
How to think about it
Recognise it: ask 'could somebody who should not, now be inside'. If yes, stop fixing. Do not power off; memory is evidence. Disconnect it from the network so it cannot reach anything else. Note the time, the user, the machine and exactly what was seen. Tell the security team now, by the desk's agreed route, not by a ticket that waits in a queue. Then do what they say, and nothing they did not.
Worked example
User: 'a note on the screen says my files are locked and I have 48 hours'The sign. This is not a 'my files will not open' ticket.
Network cable pulled, Wi-Fi off; machine left onIsolated so it cannot spread; left on so what is in memory is not lost.
Time 10:42, user, asset LT-0417, note text photographed, last thing opened: an invoice attachment at 10:30The evidence, written before it is forgotten. The attachment is the first clue.
Security team phoned on the incident number; ticket marked security incident, P1Reported by voice, now, with the ticket to follow. The desk's part is done; the rest is theirs.
Your turn
A ransom note is on the screen. Write what you do to the network cable.
Do not power off; the network cable
Solve one, graded on the server
The trap
Powering off to 'stop it'. It may stop it, and it also erases what was running, which was the only record of how it got in. Isolation is the cable, not the power button.