Responding to an exposed internet service.

Pick one person to coordinate the response and one technical contact who can safely change the service. A small team can share roles, but everyone should know who makes decisions and who contacts the provider, insurer, and leadership. Record when the issue was found, who found it, what was observed, and each action taken, with its time and owner. NIST treats preparation and coordinated response as part of ongoing cybersecurity risk management.[1]

Use a trusted phone number or a clean device if business email or chat may be affected. Keep the timeline factual; separate confirmed observations from guesses.

If the service does not need to be public, ask your hosting provider or IT administrator to restrict access at the firewall, load balancer, or cloud security group. For an infected computer, disconnect it from the network. Make the smallest change that stops likely harm, and note exactly what changed. Containment should preserve the ability to investigate where practical.[1]

Do not unplug power, reboot, wipe, or reinstall a suspected compromised server as a first move. Those actions can remove useful evidence.[2] If continued operation creates immediate danger, prioritize safety and get qualified help while documenting the decision.

Before cleanup, ask a qualified administrator or responder to preserve available server, firewall, cloud, identity, and application logs, along with relevant snapshots or backups. Capture the exposed hostname or address, service and version, alert details, and the time zone used. Preserve originals where possible and keep copies access-controlled. NIST’s response guidance covers analyzing events and maintaining information needed to handle them.[1][2]

Do not clear logs, delete accounts, run cleanup tools, or overwrite a system image before checking with your responder or insurer. Ask your cloud and software providers to retain relevant logs before their normal retention window expires.

From a device and account you trust, disable accounts that appear compromised, revoke active sessions, and rotate passwords, API keys, and tokens that may have been exposed. Start with administrator, remote-access, cloud, and service credentials. Coordinate changes so you do not lock out the recovery team or lose access to audit records. Turn on multi-factor authentication where available.

Check that backups are separate from the affected environment and cannot be silently changed with the same compromised account. Do not reconnect a restricted service until the underlying weakness is fixed and a trusted person has checked it.

If a vendor runs the exposed service, use its official security advisory or service-status page and contact support through a known channel. Confirm the affected product, version, workaround, and whether a fix is available. Ask what the vendor knows about unauthorized access, but treat that as one input to your own review—not proof that your environment was or was not affected.

Apply the vendor’s fix with your administrator, keep access limited while you verify it, and follow the vendor’s recovery advice before making the service public again.[1]

Review the period before and after discovery, as far back as useful logs allow. Look for unexpected administrator sign-ins, new users or keys, changed multi-factor settings, remote sessions, unusual data transfers, new software, altered backups, and access to other systems. Check the identity provider, cloud control plane, endpoint tools, and connected applications—not only the exposed service. NIST recommends analyzing incidents in context and coordinating response and recovery activities.[1]

If logs are missing, the service handled sensitive information, or you cannot tell whether access spread, do not guess that the issue is contained. Ask a qualified incident responder to help establish what is known and what remains uncertain.

An exposed service alone does not establish that a reportable breach occurred. Notification duties depend on what information was accessed or acquired, whose information it was, where those people live, your industry, and your contracts. Ask counsel or your privacy lead to assess the facts promptly; do not use one deadline as a rule for every business.

If personal data may be involved, ask counsel and your insurer about applicable notices and preserve the facts they will need. Start that review immediately; do not wait for a full investigation to identify a deadline that applies. Have the right team confirm what can responsibly be said and when it must be sent.

Bring in an experienced incident-response provider promptly if you suspect ransomware, attacker access to administrator or cloud accounts, data theft, financial fraud, a compromised backup, or if your team cannot safely investigate. Contact your cyber insurer early and follow its approved-provider requirements. For suspected crime or extortion, contact appropriate law enforcement using a trusted channel. NIST guidance includes coordinated response, recovery, and improvement after an incident.[1]

Restore only from backups you have checked, after the cause is addressed and credentials are secured. Bring services back in a restricted way, confirm the fix, and keep monitoring. Finish with a short record of what happened, what was changed, who was notified, and what the team will improve.