Cybersecurity for Beginners

Incident Response Basics

What to Do When Something Goes Wrong

What Is an Incident?

A cybersecurity incident is:

Any event that threatens the security, privacy, or availability of information or systems.

Incidents can include:

Phishing clicks
Malware infections
Account compromise
Lost or stolen devices
Data exposure

Not all incidents are disasters — but all deserve attention.

Why Incident Response Matters

Fast, calm action:

Limits damage
Prevents spread
Speeds up recovery
Reduces stress

Doing nothing is often worse than making a small mistake.

The Incident Response Mindset

When something happens:

Stay calm
Don’t panic
Focus on containment first

You don’t need to know everything — you just need to act wisely.

The Four Basic Steps of Incident Response

1. Recognize

Notice signs like:

Unexpected login alerts
Suspicious emails or links
Pop-ups or strange behavior
Files suddenly unavailable

Trust your instincts.

2. Contain

Limit further damage:

Disconnect from the internet
Stop interacting with suspicious messages
Lock or power down affected devices (if advised)

Containment buys time.

3. Report

Tell the right people:

IT or security teams (at work)
Account providers
Financial institutions

Reporting early helps everyone.

4. Recover

After the threat is controlled:

Change passwords
Restore from backups
Update systems
Monitor for further issues

Recovery takes patience.

What NOT to Do During an Incident

Avoid:

Ignoring the issue
Deleting evidence
Paying attackers without guidance
Trying random fixes
Feeling embarrassed

Incidents happen to everyone.

If You Clicked a Phishing Link

Immediately:

Stop interacting
Disconnect from the network
Change passwords
Enable MFA if not already active
Report the incident

Speed matters more than blame.

If You Suspect Malware

Disconnect from the internet
Don’t log into accounts
Run a security scan
Seek professional or IT help
Restore from backups if needed

Avoid spreading the infection.

Lost or Stolen Devices

Act quickly:

Use remote lock or wipe features
Change important passwords
Report to your organization or provider

Preparation helps here.

Documentation Matters

Write down:

What happened
When it happened
What actions you took

This helps investigations and future prevention.

Learning From Incidents

After recovery:

Identify what went wrong
Improve protections
Update habits or policies

Every incident is a learning opportunity.

Key Takeaways

Incidents don’t mean failure
Early action limits damage
Containment comes before cleanup
Reporting helps everyone
Recovery is possible

Quick Exercise

Imagine:

You clicked a suspicious link
Your phone was lost
You received an unexpected MFA prompt

What would your first three actions be?

Up Next

Next, we’ll cover cybersecurity myths and misconceptions — common beliefs that can actually increase risk.