Cybersecurity · Beginner level

Beginner level · Module 5: Incident Response Basics · Lesson 1 of 3

Signs of Compromise and First Steps

Recognise when something is wrong and act quickly to limit damage.

In this lesson you will

  • Recognise signs of compromise
  • Take immediate containment steps

Key concepts

signs of compromisecontainmenttrusted devicesessions

The lesson

Signs include unexpected password reset emails, sign-in alerts, messages you did not send, new forwarding rules, unknown apps or a suddenly slow device with pop-ups.

First steps for an account: from a trusted device, change the password, sign out all sessions, check MFA and recovery details, and remove unknown forwarding rules and connected apps.

For a device that may be infected, disconnect it from the network and get help before reusing it for sensitive work.

Step by step

  1. List signs of compromise.
  2. Practise changing a password and signing out all sessions.
  3. Check email forwarding rules.
  4. Review connected apps.
Step-by-step

Responding to a hacked email account

The order of actions when someone else has been using your email account.

  1. Use a trusted device

    Act from a device you believe is clean — not the one that may be infected.

  2. Change the password

    Set a new, unique, generated password and store it in the password manager.

  3. Sign out everywhere

    Use 'sign out of all sessions' so the attacker's open sessions end.

  4. Secure MFA and recovery

    Turn on MFA or re-register it; check the recovery phone and email are yours.

  5. Remove attacker changes

    Delete unknown forwarding rules, filters, connected apps and signatures.

  6. Warn and report

    Tell IT and contacts who may have received fraudulent messages; record what happened and when.

Result

The attacker is locked out, hidden forwarding is removed and others are warned before they act on fraudulent messages.

Practice activity

Walk through the hacked email scenario and record each step.

Expected result: A correct, ordered response for the scenario.

Check your understanding

  1. Why use a trusted device to change a compromised password?

    Show answer

    The compromised device may capture the new password.

  2. What hidden change do attackers often make to email accounts?

    Show answer

    Forwarding rules that copy mail to them.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.