How do you prevent a second attack straight after an incident?

To prevent a second attack straight after an incident, close every access path the attacker had, not just the one you found. Fix the entry point, rotate all exposed passwords and secrets, hunt for backdoors, rebuild compromised machines instead of cleaning them, and keep monitoring closely for several weeks.

This article belongs to our series on how incident response unfolds. For the full picture, see How does incident response work?.

Why repeat attacks are common

After an incident, an organisation is at its weakest. The attacker knows the network and may still hold valid credentials or several fallback access paths. The usual reasons they come back:

• The entry point was never fixed: the vulnerability, exposed VPN or account without MFA is still there.
• Stolen credentials still work: passwords, session tokens, API keys, service accounts.
• Persistence was missed: a scheduled task, an account the attacker created, a legitimate remote access tool turned against you.
• Stolen data is reused: to send convincing phishing emails to the company, its customers or its suppliers.
• Access is resold: one criminal group may pass access on to another.

Measures that close the door

ANSSI, France’s national cybersecurity agency, frames remediation in three stages: contain the attack, evict the attacker from the core of the network, then eradicate their footholds. In practice:

Fix the root cause

The investigation report must identify the entry point. Until it is fixed, any rebuild stands on shaky ground. See What goes into an incident report?.

Rotate every exposed secret

After a directory compromise, that covers all accounts in practice: users, admins, service accounts and the Active Directory krbtgt account. Microsoft advises resetting krbtgt twice, with a wait between resets (10 hours with default settings). In Microsoft 365, also revoke active sessions and review consented apps and mail forwarding rules. See Microsoft 365 attacks MSPs do not see coming.

Hunt for persistence

A targeted threat hunt reviews recently created accounts, scheduled tasks, services, remote access tools and unusual outbound connections. It is what lets you say, with reasonable confidence, that the attacker has gone. See How do you know the attacker is gone?.

Rebuild rather than clean

A machine compromised at admin level is rebuilt from a known-good source. Restored backups are checked before going live, because they may contain the attacker’s foothold. See When can you restart production after an attack?.

Harden the most exposed access

MFA on all remote access and privileged accounts, removal of unused accounts, separate admin accounts and patching of internet-facing equipment.

Monitor to catch a comeback

These measures cut the risk sharply without removing it. Heightened monitoring is there to catch a return attempt quickly: a sign-in from an unusual country, a new account, a remote admin tool reappearing, suspicious activity on a rebuilt machine.

That requires sensors on endpoints and servers (an EDR) and logs reviewed by analysts who are available around the clock. An attacker who returns at 3am on a Sunday must be handled at 3am on a Sunday. See Do you need an EDR for a managed SOC?.

Warn your partners

If data was stolen, tell exposed customers and suppliers that they may receive fraudulent messages using that information. Factual, early warning heads off part of the follow-on attempts.

What Cyna does in this phase

Cyna’s managed SOC, run 24/7 from France by in-house teams, works with Cyna’s CERT, a member of InterCERT France, which can be mobilised quickly. Cyna’s incident response on-call team is available 24/7 from the Report an incident page. After an intervention, continuous monitoring on SentinelOne or Microsoft Defender, and on Microsoft 365 or Google Workspace, takes over, alongside the MSP leading remediation. The terms of the SOC service (scope, licences) are set out in the contract concluded with the partner MSP.

Talk to an expert

Want to check that no access path was missed after an incident? If you work with a Cyna partner MSP, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

Do we need to reset every password after a cyberattack?

Every one that may have been exposed. After a directory compromise, that means all accounts in practice, including service accounts and the Active Directory krbtgt account, which Microsoft says to reset twice.

Does paying a ransom protect against another attack?

No. Paying closes no access path and guarantees nothing. Public bodies such as France's cybermalveillance.gouv.fr advise victims not to pay.

How long should heightened monitoring last?

There is no legal minimum. Keep it at least until remediation is complete and while suspicious signals keep appearing, then return to normal monitoring, which should itself be continuous.

Should the incident response plan be updated after an attack?

Yes. The incident shows which contacts, procedures and decisions worked and which did not. Updating the plan straight away, while memories are fresh, is one of the cheapest ways to be better prepared next time. See What happens after incident response?.