Cheat Sheets

🚨 Incident response: the first hour

1. Stay calm and start a log. Write down times, what you saw and every action taken.
2. Contain, don’t destroy. Isolate affected machines from the network. Avoid switching them off if you can, because memory holds evidence.
3. Escalate. Inform your incident lead, IT/security provider and management. Use a channel the attacker can’t read if email may be compromised.
4. Preserve evidence. Keep logs, suspicious emails and files. Don’t wipe or reinstall yet.
5. Protect accounts. Reset passwords and revoke sessions for affected and privileged accounts, from a clean device.
6. Assess scope. Which systems, data and people are affected? Is data leaving the network?
7. Check obligations. Contracts, regulators, insurers and law enforcement may need to be told within strict deadlines.

🔌 Common ports

Ports marked ⚠️ should rarely, if ever, be exposed directly to the internet.

🪟 Windows Security event IDs worth watching

🐧 Linux logs and quick checks

last -a | head                 # recent logins and source
sudo lastb | head              # recent failed logins
who                            # who is logged in now
sudo ss -tulpn                 # listening ports and owning processes
sudo journalctl -u ssh --since "24 hours ago"   # SSH activity (unit may be sshd)
ls -la /etc/cron.* ; crontab -l                  # scheduled tasks (persistence)
find / -xdev -mtime -2 -type f -perm -u+x 2>/dev/null | head   # new executables

Read-only commands for systems you own or administer. Unusual results are clues, not proof.

🔒 Small-business hardening basics

• Turn on MFA everywhere, starting with email, admin accounts and remote access. Prefer passkeys or authenticator apps.
• Patch operating systems, browsers and internet-facing apps quickly. Prioritise anything in CISA KEV.
• Remove direct internet exposure of RDP, SMB and databases. Use a VPN or zero-trust access.
• Use separate admin accounts and remove local admin rights from everyday users.
• Keep 3-2-1 backups: three copies, two media, one offline or immutable. Test restores.
• Deploy EDR on every endpoint and send logs somewhere attackers can’t delete them.
• Configure SPF, DKIM and DMARC to stop others sending email as your domain.
• Run phishing awareness training and agree a verification step for payment changes.
• Keep an asset inventory. You can’t protect what you don’t know you have.