1. Check security logs
Logging is the practice of managing the log data produced by your applications and infrastructure. Determine what logging you have in place, where logs are stored and how long logs are retained.Security monitoring is vital for the identification and detection of threats to your IT systems. Review your logs—especially antivirus logs—regularly to search for errors, anomalies or suspicious activity. Where possible, keep your logs for at least one month
.2. Check your internet footprint
Check your external internet-facing footprint is up to date. This includes checking which IP addresses your system uses and which domain names belong to you. Check that your password is secure on any domain registration account.
3. Consider performing a vulnerability scan .
To check that everything you need to patch has been patched. Better still, make this a part of a wider organisational Vulnerability Management Plan
NATIONAL CYBER SECURITY CENTRE
4. Review your incident response plan
To ensure escalation routes and contact details are up to date. Make sure your policy states who has the authority to make critical decisions and covers the procedure for any out-of-hours response. Additionally, consider how your incident response plan will be made available if your business systems are no longer functioning during an attack.
