Responding: isolating a machine

Detection only matters if it leads to action. This lesson is about the first minutes after you notice something wrong: an app connecting somewhere it should not, a Mac behaving strangely, or a warning from someone you trust that you may have been targeted. The goal here is not to fix the underlying problem yourself; it is to stop it from getting worse and to keep what you will need to get real help.

Isolate first, investigate second

NIST’s Computer Security Incident Handling Guide (SP 800-61) frames containment as a choice that has to be made quickly, and warns that “an attacker could escalate unauthorized access or compromise other systems” for as long as containment is delayed. On one Mac, containment means cutting its network access: turning off Wi-Fi, unplugging an Ethernet cable, or turning on Airplane Mode if available, rather than continuing to use it normally while you think. This does not fix anything by itself, but it stops an ongoing connection to an attacker, and stops the Mac from being used to reach anything else, such as another device on the same network or an account you are still logged into.

• Disconnect from the network: Wi-Fi off, Ethernet unplugged. This is the single most useful first action, since it cuts off both incoming instructions and outgoing data at once.
• Do not shut down or restart the Mac unless you have been told to by someone helping you. Powering off can lose information in memory that would otherwise help explain what happened, and can trigger harmful software designed to notice a shutdown and cover its tracks.
• Do not uninstall the suspicious app, delete files, or “clean up” before getting help. It is tempting, but it destroys the evidence a helper would need to understand what happened.
• If the Mac is used for work, or the incident might involve someone else’s data, tell whoever is responsible for that (an employer’s IT or security contact, an organization’s security lead) immediately, rather than after you have looked into it yourself.

Preserving what you can, briefly

NIST’s guide recommends documenting “every step taken from the time the incident was detected to its final resolution,” timestamped, ideally by someone other than the person doing the technical work. On one Mac, without a formal team, this can be simple: write down or photograph what you saw and when (the app, the destination, the time), note anything you changed (did you disconnect the network? did you close an app?), and keep any screenshots you already took. This is exactly the kind of detail the tools in the previous lesson, such as a per-app connection log, are useful for capturing before you disconnect.

Getting help

Who to contact depends on who you are and what is at stake. For most people, this starts with whoever manages the device if it is not personal (an employer, an organization’s IT), or a trusted, technically capable person if it is. For journalists, activists, human rights defenders and others who may be targeted because of their work, two organizations specifically offer this kind of support at no cost:

• Access Now’s Digital Security Helpline offers rapid-response help, in multiple languages, for civil society groups and individuals who believe they are at risk or already under attack, after a vetting process to confirm they fall within its mandate.
• Freedom of the Press Foundation offers digital security training and personalized advice for journalists and newsrooms, including guidance on device security and source protection.

Neither organization, nor this lesson, can promise that any set of steps makes a targeted person safe; the honest goal is reducing risk and getting a knowledgeable person involved quickly, not eliminating it.