DEV Community

zikarelhub
zikarelhub

Posted on

Nigerian Business Incident Response — A Technical Playbook for Cyber Attacks

#security #nigeria #cybersecurity #devops

Most Nigerian businesses have no incident response plan. Here's the technical playbook that changes that.

The First 30 Minutes 

1. DON'T delete anything — preserve evidence
2. DISCONNECT (don't shutdown) compromised systems
3. SCREENSHOT all unusual activity with timestamps
4. CALL your security contact — not email, phone
5. CHANGE admin credentials on clean systems
Enter fullscreen mode Exit fullscreen mode

Why disconnect not shutdown? Shutdown destroys volatile memory that contains critical forensic data about attacker activity. Disconnect from network stops the attack while preserving evidence.

Automated Detection 

// Run every 5 minutes in production
async function runSecurityChecks() {
  const alerts = [];

  // Mass data access — possible exfiltration
  const massAccess = await AuditLog.findAll({
    attributes: ['userId', [db.fn('COUNT', db.col('id')), 'count']],
    where: {
      action: 'DATA_READ',
      createdAt: { [Op.gte]: new Date(Date.now() - 60 * 60 * 1000) }
    },
    group: ['userId'],
    having: db.literal('COUNT(id) > 1000')
  });

  if (massAccess.length > 0) {
    alerts.push({
      severity: 'CRITICAL',
      type: 'MASS_DATA_ACCESS',
      action: 'Suspend accounts and alert security team immediately'
    });
  }

  if (alerts.length > 0) {
    await sendTelegramAlert(formatAlerts(alerts));
  }
}
Enter fullscreen mode Exit fullscreen mode

NDPR 72-Hour Clock

The moment you discover a breach involving personal data, a 72-hour clock starts for NITDA notification. This deadline applies to the discovery time — not the end of your investigation.

const nitdaDeadline = new Date(discoveryTime.getTime() + 72 * 60 * 60 * 1000);
// Email: info@nitda.gov.ng
// Include: what happened, what data, how many affected, what you're doing
Enter fullscreen mode Exit fullscreen mode

Emergency Containment 

// Isolate compromised account
async function isolateAccount(userId, incidentId) {
  await User.update(
    { status: 'SUSPENDED' },
    { where: { id: userId } }
  );

  // Kill all active sessions
  await Session.destroy({ where: { userId } });

  // Revoke all API tokens
  await APIToken.update(
    { revoked: true },
    { where: { userId } }
  );
}

// Emergency read-only mode
app.use((req, res, next) => {
  const isWriteOp = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method);
  if (isWriteOp && systemConfig.readOnlyMode) {
    return res.status(503).json({ error: 'Maintenance mode active' });
  }
  next();
});
Enter fullscreen mode Exit fullscreen mode

Recovery Checklist 

Pre-Recovery:
[ ] Patch the vulnerability that allowed the breach
[ ] Verify attacker access completely removed
[ ] Rotate ALL compromised credentials
[ ] Verify backup integrity before restoring

Recovery:
[ ] Restore from verified clean backup
[ ] Security controls verified active
[ ] Monitoring and alerting verified

Post-Recovery:
[ ] Penetration test restored systems
[ ] NDPR notification filed with NITDA
[ ] Affected customers notified
[ ] Post-incident review documented
Enter fullscreen mode Exit fullscreen mode

ZikarelHub LTD is Nigeria's #1 software and digital agency — incident response planning and cybersecurity built into everything we create.

Top comments (0)